--- cve: "CVE-2026-48779" severity: "HIGH" cvss: 7.5 epss: "1.4%" vendor: "websockets" kev: false exploited: false published: "2026-06-17 13:20:42" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-11-07T22:50:51+01:00" --- # CVE-2026-48779 > 7.5 HIGH · 🧪 PoC ## Beschreibung ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0. ## CNA-Record (Kanon, cvelistV5) - CNA: **GitHub_M** - State: PUBLISHED - Stand: 2026-09-11 12:09:07 - CNA-CVSS: **7.5** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`) ## CISA-Anreicherung (vulnrichment/ADP) - CISA-SSVC (Coordinator, v2.0.3): - Exploitation: **poc** - Automatable: **yes** - Technical Impact: **partial** ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Keine | good | | I Integrität | Keine | good | | A Verfügbarkeit | Hoch | bad | ## Schwachstellen-Klasse - **CWE-1050** — Excessive Platform Resource Consumption within a Loop The product has a loop body or loop condition that contains a control element that directly or indirectly consumes platform resources, e.g. messaging, sessions, locks, or file descriptors. - **CWE-400** — Uncontrolled Resource Consumption The product does not properly control the allocation and maintenance of a limited resource. - **CWE-770** — Allocation of Resources Without Limits or Throttling The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. ## Patch verfügbar (OSV) - b5372ac67bb97a773727b8e9f5035a8123556d53 (Commit) - 86d3e8a5fb0246ed373860c5fbb0de88824a27f7 (Commit) ## BSI-Hinweise (deutsch) - [Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2923) — _BSI-Einstufung: hoch_ Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Atlassian Bitbucket, Atlassian Confluence, Atlassian Crucible, Atlassian Fisheye und Atlassian Jira ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen. - [Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2460) — _BSI-Einstufung: hoch_ Ein Angreifer kann mehrere Schwachstellen in Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management ausnutzen, um beliebigen Code auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand auszulösen. ## Referenzen - - - - - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-48779/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_