CVE-2026-10099 XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py

🗓️ 29 May 2026 15:58:24Reported by GoogleType

osv

osv🔗 osv.dev👁 2 Views

XX-Net V5.16.6 WebSocket flaw: unmasked frames corrupt payload by masking key misread.

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2026-10099	29 May 202615:58	–	attackerkb
CNNVD	XX-Net 安全漏洞	29 May 202600:00	–	cnnvd
CVE	CVE-2026-10099	29 May 202615:58	–	cve
Cvelist	CVE-2026-10099 XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py	29 May 202615:58	–	cvelist
EUVD	EUVD-2026-33346	29 May 202615:58	–	euvd
NVD	CVE-2026-10099	29 May 202616:16	–	nvd
Positive Technologies	PT-2026-44889	29 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-10099	1 Jun 202622:03	–	redhatcve
Vulnrichment	CVE-2026-10099 XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py	29 May 202615:58	–	vulnrichment

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10099.json
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-10099
vulncheck	www.vulncheck.com/advisories/xx-net-websocket-frame-parsing-data-corruption-via-simple-http-server-py
github	www.github.com/XX-net/XX-Net/issues/14169
github	www.github.com/XX-net/XX-Net/pull/14170
github	www.github.com/XX-net/XX-Net/commit/a68b972a84ed6e52df9f30237cf47493b9231b53

08 Jul 2026 08:08Current

6Medium risk

Vulners AI Score6

CVSS 45.1

EPSS0.00125

WebSocket frame parsing payload corruption unmasked frames masking key handling XX-Net vulnerability CVE-2026-10099