Restbed EUVD-2026-90203

Exploitation requires that the target run a restbed (through 5.0.0) service with a WebSocket endpoint reachable by the attacker; the flaw is in restbed's WebSocket frame handling, which accepts declared payload lengths up to 2^63 bytes and buffers payload data into an unbounded stream buffer without size limits. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and default configurations are affected wherever WebSocket support is enabled and exposed. The primary limiting factor is deployment surface: only restbed-based services that actually expose WebSocket endpoints to untrusted networks are exploitable, and impact is confined to availability (process crash) - there is no path to data disclosure or code execution.

The signals align coherently for a genuine but scope-limited denial-of-service issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, base 8.7) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction that impacts availability ONLY - confidentiality and integrity are untouched (VC:N/VI:N), consistent with CWE-770 (Uncontrolled Resource Allocation) memory exhaustion rather than code execution. My independent CVSS 3.1 mapping is A:H-only, ~7.5, meaning the 8.7 4.0 headline is real but describes a crash/DoS, not compromise. Exploitation status: no public exploit identified at time of analysis - there is no CISA KEV listing, no EPSS score provided, and no explicit POC in the references (the GitHub issue #558 and VulnCheck advisory document the flaw and source line but are not weaponized exploit code). There are no conflicting signals: the description's 'remote unauthenticated' language matches PR:N and AV:N in the vector. The main factor moderating real-world priority is product prevalence - restbed is a niche C++ REST/WebSocket framework, not ubiquitous infrastructure - so this is a legitimate patch-worthy DoS for anyone running restbed WebSocket endpoints on the public internet, but not a broad-impact emergency.

An attacker who can reach a restbed WebSocket endpoint opens a connection and sends a WebSocket frame header declaring a very large payload length (up to 2^63 bytes), then streams payload data that restbed buffers into an unbounded stream buffer with no size cap. Sustained or repeated frames drive the server process to exhaust available memory and crash, denying service to legitimate clients. No authentication, user interaction, or special timing is required, though no public exploit code has been identified.