PT-2026-32068
تاريخ النشر
2026-03-31
·
تاريخ التحديث
2026-03-31
الوصف من
CVSS 4.0
5.3
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Summary
The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget.
Impact
An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients.
Affected Component
src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.tsFixed Versions
- Affected:
<= 2026.3.24 - Patched:
>= 2026.3.28 - Latest stable
2026.3.28contains the fix.
Fix
Fixed by commit
cb5f7e201f (gateway: cap concurrent pre-auth websocket upgrades).Discovered by：Topsec AlphaLab (wang dong)
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾