Restbed
Monthly
Memory exhaustion denial of service in restbed through 5.0.0 allows remote unauthenticated attackers to crash server processes by sending WebSocket frames that declare payload lengths up to 2^63 bytes and then streaming data into an unbounded buffer. Any restbed-based service that exposes a WebSocket endpoint to an untrusted network is potentially affected, and no credentials or user interaction are required. The impact is confined to availability (process crash/OOM), with no data disclosure or code execution path; no public exploit code or confirmed active exploitation has been identified at time of analysis. The CVSS 4.0 base score is 8.7, and an independent CVSS 3.1 assessment aligns as a genuine but scope-limited denial-of-service issue.
Unbounded HTTP request-header buffering in Corvusoft restbed 5.0.0 and earlier allows remote unauthenticated attackers to exhaust server heap memory and kill the process, producing a denial of service against any network-reachable service built on the framework. The attack requires nothing more than opening TCP connections and streaming header bytes indefinitely without ever sending the terminating blank line, so the server keeps growing its header buffer until memory is exhausted; no credentials, feature flags, or user interaction are involved (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no data disclosure or code execution - and no public exploit code has been identified at time of analysis, though the technique is straightforward to reproduce by hand. Exposure is materially reduced where a reverse proxy or load balancer in front of restbed enforces its own header-size and header-timeout limits.
Memory exhaustion denial of service in restbed through 5.0.0 allows remote unauthenticated attackers to crash server processes by sending WebSocket frames that declare payload lengths up to 2^63 bytes and then streaming data into an unbounded buffer. Any restbed-based service that exposes a WebSocket endpoint to an untrusted network is potentially affected, and no credentials or user interaction are required. The impact is confined to availability (process crash/OOM), with no data disclosure or code execution path; no public exploit code or confirmed active exploitation has been identified at time of analysis. The CVSS 4.0 base score is 8.7, and an independent CVSS 3.1 assessment aligns as a genuine but scope-limited denial-of-service issue.
Unbounded HTTP request-header buffering in Corvusoft restbed 5.0.0 and earlier allows remote unauthenticated attackers to exhaust server heap memory and kill the process, producing a denial of service against any network-reachable service built on the framework. The attack requires nothing more than opening TCP connections and streaming header bytes indefinitely without ever sending the terminating blank line, so the server keeps growing its header buffer until memory is exhausted; no credentials, feature flags, or user interaction are involved (CVSS:4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VA:H, assessed as CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Impact is confined to availability - there is no data disclosure or code execution - and no public exploit code has been identified at time of analysis, though the technique is straightforward to reproduce by hand. Exposure is materially reduced where a reverse proxy or load balancer in front of restbed enforces its own header-size and header-timeout limits.