Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

CVE-2026-65623 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

EUVD-2026-48718

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

EEF-CVE-2026-65623 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

Summary Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversize\message?/2 called from handle\frame/3 in...

CVE-2026-65623

CVE-2026-65623 describes a Quadratic CPU blow-up in Bandit’s WebSocket message reassembly. The vulnerability arises when handling fragmented WebSocket frames: each non-final continuation frame is appended to a left-nested iolist and the entire buffer is re-measured with IO.iodata_length/1 on ever...

CVE-2026-65623 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

CVE-2026-65623 Quadratic CPU blow-up reassembling fragmented WebSocket messages in Bandit

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

CVE-2026-65623

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

CVE-2026-65623

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

SUSE-SU-2026:22920-1 Security update for libsoup

This update for libsoup fixes the following issues: - Incomplete fix for CVE-2026-12478: out-of-bounds read in the processframe function of SoupWebSocketConnection bsc1271401...

PT-2026-67603

Summary @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even...

PT-2026-67590

Summary http4s-blaze-server aggregates the fragments of an incoming WebSocket message with no limit on total size or fragment count. A client that completes a WebSocket handshake can send an unterminated fragmented message and drive unbounded heap growth in the server JVM, resulting in denial of...

PT-2026-67604

Summary When an SSO-authenticated user tests an automation in the Budibase builder, their OAuth2 access token and refresh token are included in the automation test results. These results are broadcast via WebSocket to all builders connected to the same dev app and stored in an in-memory cache...

CVE-2026-65623: Inefficient Algorithmic Complexity

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversizemessage?/2 called from handleframe/3 in...

PT-2026-71709

Name of the Vulnerable Software and Affected Versions Hub versions prior to 0.2.16 Description Unauthenticated WebSocket connections trigger the loadDefaultConnectionEventListeners function to call requestClientId, which subsequently executes rpc.send for the get-client-id action and adds a reque...

Vaultwarden -- multiple vulnerabilities

The Vaultwarden project reports: SSRF via the icon endpoint GHSA-hw4g-2v3f-74x5 GHSA-vh5m-fc9v-m84g Medium, 5.8 / 6.3 Cross-Organization Cipher Access GHSA-xwf8-pjh7-h589 Medium, 5.9 Organization Policy Bypass on Directory Import GHSA-88qc-6ch9-mc3j Medium, 5.5 Send Access-Count Bypass...

PT-2026-64373

Inefficient Algorithmic Complexity vulnerability in mtrudel bandit allows unauthenticated remote denial of service via CPU exhaustion during WebSocket fragment reassembly. The size guard 'Elixir.Bandit.WebSocket.Connection':oversize message?/2 called from handle frame/3 in...

SUSE SLES15 Security Update : python-aiohttp (SUSE-SU-2026:3208-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3208-1 advisory. - CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. -...

Apache Camel WebSocket Component Disclosure

The vulnerability of the sendEventNotification and getQueryMap functions in the WebsocketConsumer class of the camel-atmosphere-websocket component of the Apache Camel framework is related to insufficient validation of input data during the processing of WebSocket request parameters. Exploiting...

Security update for python-aiohttp

This update for python-aiohttp fixes the following issues: CVE-2026-50269: improper validation of user-controlled strings allows for CRLF injection in multipart headers bsc1268398. CVE-2026-54273: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption bsc1268543...