CVE-2026-10099— XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-10099
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py
Source: NVD (National Vulnerability Database)
Vulnerability Description
XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header, causing the first 4 bytes of payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, resulting in data corruption alongside missing RSV bit, opcode, and FIN fragmentation validations.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
CWE-1286
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-10099
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10099
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-10099 (2)
Vendor Advisories for CVE-2026-10099 (2)
IV. Related Vulnerabilities
Same weakness: CWE-1286
- CVE-2026-7307
Keycloak: keycloak: denial of service via specially crafted - CVE-2026-0983
Denial of service vulnerability in M-Files Server - CVE-2026-6442
Improper Command Detection Logic Allows RCE in Cortex Code C - CVE-2026-40198
Net::CIDR::Lite versions before 0.23 for Perl does not valid - CVE-2026-33778
Junos OS: SRX Series, MX Series: When a specifically malform
V. Comments for CVE-2026-10099
No comments yet