CVE-2026-86065: Allocation of Resources Without Limits or Throttling

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has n...

CVE-2026-86064: Exposure of Sensitive Information to an Unauthorized Actor

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured in config/node/api.yaml and registered by network/api/api.go does not require authentication. The first client message is parsed as a logger Profile in...

PT-2026-97530

Name of the Vulnerable Software and Affected Versions Klever-Go versions prior to 1.7.20 Description The 'GET /subscribe' endpoint accepts unauthenticated WebSocket clients with permissive origin handling and lacks a live-connection cap or a call to SetReadLimit to bound message size. Additionall...

PT-2026-105063

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set max frame size, so cowboy's default of infinity...

CVE-2026-67232: Improper Handling of Highly Compressed Data (Data Amplification)

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress = true, enabling RFC 7692 permessage-deflate negotiation. The handler does not set maxframesize, so cowboy's default of infinity applies...

CVE-2026-50227: Missing Authentication for Critical Function

An unauthenticated local attacker can connect to the MQTT broker over its localhost WebSocket endpoint in Acer NitroSense software versions up to and including 5.2.62. This allows the attacker to invoke exposed ddsc RPC functions, including childprocess.execSync, resulting in arbitrary command...

PT-2026-97587

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description The Web-MQTT handler and the Web-STOMP handler do not validate...

PT-2026-97584

Name of the Vulnerable Software and Affected Versions RabbitMQ versions prior to 3.13.15 RabbitMQ versions prior to 4.0.20 RabbitMQ versions prior to 4.1.11 RabbitMQ versions prior to 4.2.6 RabbitMQ versions prior to 4.3.0 Description An unauthenticated attacker can crash a node running the...

Linux Distros Unpatched Vulnerability : CVE-2026-83599

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, a...

TencentOS Server 4: nodejs20 (TSSA-2026:1043)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1043 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2026-79677: Missing Release of Resource after Effective Lifetime

Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of service as a result of lost time outs for asynchronous WebSocket writes. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through...

EUVD-2026-83415

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation...

Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...

GHSA-HXP9-W8X3-P566 Autobahn Python permessage-deflate bypasses maxMessagePayloadSize after inflation

Summary Autobahn Python enforces maxMessagePayloadSize against the compressed WebSocket frame length before permessage-deflate inflation, then delivers the inflated message to application callbacks without a second size check. A client frame that is only 22 compressed bytes can inflate to 4096...

SIPGO: DoS via unvalidated WebSocket frame length

Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. Details WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload...

GHSA-8H6X-H86X-75WH SIPGO: DoS via unvalidated WebSocket frame length

Summary The WebSocket transport allocates a buffer from the frame payload length before validating its size, which can lead to an unauthenticated DoS. Details WSConnection.Read allocates a buffer from the declared WebSocket frame length before reading the payload...

deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

Summary The RECORDACTION.PATCHMULTI action is not registered in the Valve permission system's RULESMAP src/services/permission/valve/rules-map.ts. When ConfigPermission.canPerformAction is called for a PATCHMULTI message, getRulesForMessage returns null because the action is missing from the map...

CVE-2026-77322 SIPGO: DoS via unvalidated WebSocket frame length

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transportws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated ...

CVE-2026-77322 SIPGO: DoS via unvalidated WebSocket frame length

SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.3, WSConnection.Read in sip/transportws.go creates a wsutil.Reader without setting MaxFrameSize, allowing NextFrame to accept a client-controlled header.Length before ParseMaxMessageLength is applied. An unauthenticated ...

CVE-2026-77322

The SIPGO library (prior to version 1.4.3 ) is vulnerable to a Denial of Service (DoS) attack via unvalidated WebSocket frame lengths. The root cause is located in sip/transport_ws.go, where WSConnection.Read creates a wsutil.Reader without setting the MaxFrameSize parameter. This allows an unaut...