Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

websocket

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.5crates.ioPublished

    Rust-WebSocket memory allocation based on untrusted length

    CVE-2022-35922 · GHSA-qrjv-rf5q-qpxc

    Affected
    • crates.io websocket < 0.26.5
    Fixed in
    0.26.5· Vendor fix available
    Issue
    Impact Untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When Vec::withcapacity fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use withcapacity, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker. This is a security concern for you, if - your server application handles untrusted websocket connections - OR your client application connects to untrusted websocket servers Patches The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version. Note that default memory limits are…

    Recommended action: Upgrade to 0.26.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →