CVE-2026-10099 XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py
Attackers can corrupt application data by sending unmasked WebSocket frames due to improper parsing logic in XX-Net's HTTP server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-10099?
CVE-2026-10099 is a medium-severity vulnerability in XX-Net, published on 29 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header, causing the first 4 bytes of payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, resulting in data corruption alongside missing RSV bit, opcode, and FIN fragmentation validations.
Weakness: CWE-1286
Which versions are affected by CVE-2026-10099?
How do I fix CVE-2026-10099?
No fix has been published for CVE-2026-10099 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-10099 being exploited?
There is no known exploitation of CVE-2026-10099 in the wild and no public exploit code.
Sources
Also known as GHSA-cwjv-w927-x7gr.