CVE-2026-51082

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment PVE 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 PVE 9.x and before 5.3.4 PVE 8.x allows an attacker with...

libevent: Libevent: Remote denial of service via unbounded memory accumulation in WebSocket server

A flaw was found in Libevent. An unauthenticated remote client can exploit this vulnerability by repeatedly sending fragmented WebSocket frames to the Libevent WebSocket server. Due to a lack of a total message-size limit, these fragmented frames accumulate in memory without bound, leading to...

CVE-2026-62220

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

Brute Force

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Brute Force via the WebSocket authentication. An attacker can exhaust gateway resources and reduce service availability by sending repeated authentication attempts that bypass rate...

CVE-2026-62220

Summary: CVE-2026-62220 affects OpenClaw 2026.2.25 prior to 2026.5.26, where a lower-trust caller or configured input path can bypass non-browser rate limits on WebSocket authentication attempts. What’s affected: OpenClaw WebSocket authentication flow when the rate-limiting feature is enabled and...

CVE-2026-62220 OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

CVE-2026-62220 OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

CVE-2026-62220

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

EUVD-2026-45108

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

CVE-2026-62220 OpenClaw 2026.2.25 < 2026.5.26 WebSocket Rate Limit Bypass

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

CVE-2026-62220

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

CVE-2026-62220: Improper Restriction of Excessive Authentication Attempts

OpenClaw 2026.2.25 before 2026.5.26 allow a lower-trust caller or configured input path to bypass non-browser rate limits on WebSocket authentication attempts. When the affected feature is enabled and reachable by lower-trust input, this can consume gateway resources and reduce service availabili...

CVE-2026-54490: Allocation of Resources Without Limits or Throttling

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked...

CVE-2026-54466: Improper Handling of Length Parameter Inconsistency

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite...

CVE-2026-54464: Allocation of Resources Without Limits or Throttling

Impact If this library is used in tandem with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size. This is because this limit is checked against the message frames' length headers, which give the si...

CVE-2026-54465: Allocation of Resources Without Limits or Throttling

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server or to complement a WebSocket client, a peer can make a single connection consume an unbounded...

CVE-2026-54463: Allocation of Resources Without Limits or Throttling

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, draft versions of the WebSocket protocol in websocket-driver include a length header that allows an arbitrarily large integer to be encoded as bytes with the high bit set, and a server or client can send an...

PT-2026-60630

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.2.25 through 2026.5.25 Description A flaw allows a lower-trust caller or configured input path to bypass non-browser rate limits during WebSocket authentication attempts. If the affected feature is enabled and accessible...

Vertx Websocket Component SSRF Information Disclosure

The vulnerability of the VertxWebsocketConsumer.populateExchangeHeaders method in the Vertx WebSocket component from the Java framework Apache Camel is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to disclose sensitive information and...

CVE-2026-62963

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uniwebsocket.compression enabled enforced uniwebsocket.messagesizelimit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but...