Corvusoft restbed: Memory exhaustion via unbounded WebSocket frame buffering
Summary
The restbed C++ framework accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits. A remote, unauthenticated attacker can declare large frames and stream data to exhaust server memory, crashing the process and causing a denial of service. Only applications that embed restbed and expose WebSocket endpoints are affected.
Affected
- restbed versions through 5.0.0 (all versions up to and including 5.0.0)
- Affected component: WebSocket frame handling
- Applications that embed restbed and expose WebSocket endpoints
Fixed in
Unknown. No fixed release or vendor advisory was found at the time of writing.
Workaround
- Disable WebSocket endpoints that are not needed.
- Keep WebSocket endpoints off the internet or restrict them to trusted networks.
- Place a reverse proxy in front that enforces maximum frame and message sizes.
- Limit process memory with OS tools (for example systemd MemoryMax or cgroups) so a crash is contained.
Exploitation
- Known exploited: Unknown. Not marked as known exploited in the sources checked.
- CISA SSVC: exploitation none, automatable yes, technical impact partial.
- Public proof of concept: unclear. A PoC section exists in the GitHub issue but its content was not verified.
Our recommendation
- Check whether your software or any third-party product embeds restbed, and ask the vendor or developer for a fixed build.
- Restrict or remove exposed WebSocket endpoints, especially those reachable from the internet.
- Apply reverse proxy limits and memory caps as interim mitigations.
- Monitor services for memory growth and unexpected process crashes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- GitHub issue #558 github.com
- restbed repository github.com
- OSV CVE-2026-103472 osv.dev
- Vulnerable source code (web_socket_impl.cpp) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:36.
Original description (NVD)
restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.
NVD references (4)
- https://github.com/Corvusoft/restbed
- https://github.com/Corvusoft/restbed/blob/e1227a297ce6d4e9f78222456507b29bb8ab77e9/src/corvusoft/restbed/deta…
- https://github.com/Corvusoft/restbed/issues/558
- https://www.vulncheck.com/advisories/restbed-through-5.0.0-websocket-memory-exhaustion-via-unbounded-frame-bu…
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.