ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🗓️ 20 Aug 2026 16:08:12Reported by RedHatType

redhat🔗 access.redhat.com👁 3 Views

ws WebSocket library vulnerable to DoS via memory exhaustion from small fragments.

Reporter	Title	Published	Views	Family All 138
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	12 Aug 202613:52	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Jul 202619:10	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in ws affects IBM Netezza Appliance	10 Aug 202612:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	7 Aug 202615:45	–	ibm
Atlassian	DoS (Denial of Service) ws Dependency in Bitbucket Data Center	11 Aug 202611:31	–	atlassian
Atlassian	DoS (Denial of Service) ws Dependency in Confluence Data Center	17 Jun 202623:06	–	atlassian
Chainguard	CVE-2026-48779 vulnerabilities	16 Jun 202620:22	–	cgr
Circl	CVE-2026-48779	22 May 202618:05	–	circl
CVE	CVE-2026-48779	16 Jun 202621:26	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	10.2	x86_64	rh-podman-desktop	1.1.2-1.el10_2	rh-podman-desktop-1.1.2-1.el10_2.x86_64.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-48779
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7
github	www.github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53
github	www.github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94
github	www.github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8
github	www.github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48779
cve	www.cve.org/CVERecord

21 Aug 2026 08:27Current

5Medium risk

Vulners AI Score5

CVSS 3.17.5

EPSS0.00782

SSVC

ws memory exhaustion denial of service WebSocket fragments remote attack