CVE-2026-90927 filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...

CVE-2026-90927: Uncontrolled Resource Consumption

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service...

daphne: daphne: Denial of Service via excessive WebSocket message size

A flaw was found in daphne. An unauthenticated remote attacker could exploit this vulnerability by sending arbitrarily large WebSocket messages or frames. This oversight in payload size handling can lead to excessive memory consumption, resulting in a denial of service DoS for the affected system...

PT-2026-61566

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0 Description Anonymous WebSocket connections to the '/sql' endpoint do not enforce the SURREAL WEBSOCKET MAX MESSAGE SIZE limit. This allows attackers to buffer unbounded frames in the per-connection read buffe...

CVE-2025-0189 Denial of Service in aimhubio/aim

In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket messages, allowing very large images to be tracked. This causes the server to become unresponsive to other requests while processing the large...