Corvusoft vulnerabilities

Products

• restbed 2

Latest Corvusoft CVEs

Newest publication first

1. CVE-2026-103472 restbed through 5.0.0 WebSocket Memory Exhaustion via Unbounded Frame Buffering

   Published 2026-09-30

   High·CVSS 8.7

   restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory...

2. CVE-2026-103471 restbed through 5.0.0 Denial of Service via Unbounded Header Buffering

   Published 2026-09-30

   High·CVSS 8.7

   restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.