ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments

🗓️ 10 Sep 2026 16:34:06Reported by RedHatType

redhat🔗 access.redhat.com👁 5 Views

Memory exhaustion DoS in ws via small WebSocket fragments causing process termination.

Reporter	Title	Published	Views	Family All 413
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operator and operands are vulnerable to loss of confidentiality and denial of service due to multiple CVEs	12 Aug 202613:52	–	ibm
IBM Security Bulletins	Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.	3 Aug 202611:18	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Voice Gateway	7 Jul 202619:10	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in ws affects IBM Netezza Appliance	10 Aug 202612:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Security QRadar EDR Software	27 Aug 202615:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	7 Aug 202615:45	–	ibm
Atlassian	DoS (Denial of Service) ws Dependency in Bitbucket Data Center	11 Aug 202611:31	–	atlassian
Atlassian	DoS (Denial of Service) ws Dependency in Confluence Data Center	17 Jun 202623:06	–	atlassian
Chainguard	CVE-2026-48779 vulnerabilities	16 Jun 202620:22	–	cgr
Circl	CVE-2026-48779	22 May 202618:05	–	circl

Vulners

Node

AND

redhat amq_brokerRange<7.14

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-48779
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/websockets/ws/commit/86d3e8a5fb0246ed373860c5fbb0de88824a27f7
github	www.github.com/websockets/ws/commit/b5372ac67bb97a773727b8e9f5035a8123556d53
github	www.github.com/websockets/ws/commit/bca91adf15677e47dbe4f959653452727be28b94
github	www.github.com/websockets/ws/commit/fd36cd864fcdf62a08273a99e19a7d975401fee8
github	www.github.com/websockets/ws/security/advisories/GHSA-96hv-2xvq-fx4p
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-48779
cve	www.cve.org/CVERecord

11 Sep 2026 19:11Current

CVSS 3.17.5

EPSS0.00812

SSVC

ws memory exhaustion WebSocket fragments denial of service process termination