CVE-2026-10099

What it is

XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header, causing the first 4 bytes of payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, resulting in data corruption alongside missing RSV bit, opcode, and FIN fragmentation validations.

At a glance

Exploitability

Can be exploited locally on the machine without logging in. Limited direct impact.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-05-29 16:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-06 22:10 UTC Last updatedMost recent change to the record

Details

Published

2026-05-29 16:16 UTC

Last modified

2026-10-06 22:10 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-1286

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 5.1

Attack vector

Local

Complexity

Low

Attack requirements

None

Privileges needed

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None