CyberRota Analysis
AI-GeneratedThe libevent WebSocket server is vulnerable to a denial-of-service attack due to improper handling of fragmented WebSocket frames, allowing unauthenticated remote clients to exhaust system memory by sending an unlimited number of fragmented frames. This can lead to application crashes or degraded performance, making it critical for organizations using affected versions of libevent (prior to 2.2.2-alpha) to prioritize patching this vulnerability. Users of the library should update to version 2.2.2-alpha or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.