GCVE - cpe:2.3:a:xx-net:xx-net:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:xx-net:xx-net:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
`pkg:github/xx-net/xx-net`	purl2cpe	2026-09-15 20:25:04.523947

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-10099`	vulnerable	2026-06-08 07:47:13.628547	XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py MEDIUM (4) XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header, causing the first 4 bytes of payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, resulting in data corruption alongside missing RSV bit, opcode, and FIN fragmentation validations. Published: 2026-05-29T15:58:24.062Z Updated: 2026-06-23T16:13:39.435Z Open on db.gcve.eu Reference links https://github.com/XX-net/XX-Net/issues/14169 https://github.com/XX-net/XX-Net/pull/14170 https://github.com/XX-net/XX-Net/commit/a68b972a84ed6e52df9f30237cf47493b9231b53 https://www.vulncheck.com/advisories/xx-net-websocket-frame-parsing-data-corruption-via-simple-http-server-py	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Inspect record JSON

Open this panel to browse, search, copy or download the JSON record.