XX-Net EUVD-2026-33346

XX-Net is a network circumvention proxy tool that embeds a custom Python HTTP/WebSocket server in code/default/lib/noarch/simple_http_server.py. RFC 6455 §5.2 defines the WebSocket framing protocol: bit 7 of the second header byte is the MASK flag, and when set, a 4-byte masking key follows the (extended) payload length field before the payload itself. The vulnerable WebSocket_receive_worker routine failed to check this MASK bit, instead unconditionally calling self.rfile.read(4) to extract a masking key regardless of frame type. The result is a systematic off-by-four byte alignment error: for any unmasked frame, the key array is populated with payload bytes, the remaining payload is XOR-decoded against those incorrect bytes, and the decoded string is silently passed upstream as legitimate application data. The description also notes missing validations for RSV bits, opcodes, and FIN fragmentation - suggesting the parser has broader RFC 6455 compliance gaps beyond the MASK bit issue. CWE-1286 (Improper Validation of Specified Type of Input) accurately describes the root cause: the code treats the MASK flag's value as irrelevant and applies a fixed parsing path regardless of what the protocol header signals.