Nanomsg
Monthly
Heap-based buffer overflow in the Nanomsg WebSocket transport (versions 0.5-beta through 1.x before 1.2.3) allows remote attackers to corrupt heap memory by sending an oversized Sec-WebSocket-Version header during the WebSocket handshake, which is processed before any authentication or user interaction takes place. Exploitation requires that the target application actually enable and expose nanomsg's ws transport; TCP- or IPC-only deployments are unaffected. The flaw yields high integrity and availability impact, and while reliable code execution depends on heap layout and platform, no public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (not in CISA KEV).
Heap-based buffer overflow in the Nanomsg WebSocket transport (versions 0.5-beta through 1.x before 1.2.3) allows remote attackers to corrupt heap memory by sending an oversized Sec-WebSocket-Version header during the WebSocket handshake, which is processed before any authentication or user interaction takes place. Exploitation requires that the target application actually enable and expose nanomsg's ws transport; TCP- or IPC-only deployments are unaffected. The flaw yields high integrity and availability impact, and while reliable code execution depends on heap layout and platform, no public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (not in CISA KEV).