PT-2026-32068

Published

2026-03-31

·

Updated

2026-03-31

Description by

CVSS 4.0
5.3
Medium
MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Summary

The gateway accepted unbounded concurrent unauthenticated WebSocket upgrades before allocating them to an authenticated session budget.

Impact

An unauthenticated network attacker could consume socket and worker capacity and disrupt WebSocket availability for legitimate clients.

Affected Component

src/gateway/server-http.ts, src/gateway/server/preauth-connection-budget.ts

Fixed Versions

  • Affected: <= 2026.3.24
  • Patched: >= 2026.3.28
  • Latest stable 2026.3.28 contains the fix.

Fix

Fixed by commit cb5f7e201f (gateway: cap concurrent pre-auth websocket upgrades).
Discovered by：Topsec AlphaLab (wang dong)
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-400: Uncontrolled Resource Consumption
Related identifiers
GHSA-F44P-C7W9-7XR7
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com