CVE-2026-63495

CVE-2026-63495 is a memory-exhaustion vulnerability in libevent's WebSocket implementation (versions 2.2.0-alpha through 2.2.1-alpha). The library correctly limits individual WebSocket frames to WS_MAX_RECV_FRAME_SZ, but it never enforces any limit on cumulative reassembly size for fragmented messages (FIN=0 frames). An attacker can open a single WebSocket connection and stream frames below the frame-size threshold indefinitely, forcing unbounded server-side memory allocation. This requires minimal bandwidth from the attacker while consuming potentially gigabytes on the server. The dangerous implication: developers who see WS_MAX_RECV_FRAME_SZ and assume the library handles security boundaries are unknowingly exposed. The constant exists exactly where a developer looks first, creating a false sense of coverage. The aggregate limit that actually matters — total reassembled message size — doesn't exist, and its absence is invisible precisely because the frame-level constant is present. This matters particularly because libevent is foundational infrastructure. It's embedded in proxy servers, load balancers, and tooling whose blast radius already spans many downstream applications. A vulnerability here isn't a crack in one server — it's a crack in a load-bearing wall that multiple systems share. The fix landed in 2.2.2-alpha, but the deeper question is whether other protocol implementations in libevent (HTTP, DNS, bufferevents) have the same gap. The pattern — streaming parser with state but no aggregate bounds — has appeared across HTTP/1.1 chunked encoding, SIP, and RPC frameworks repeatedly. The institutional lesson keeps evaporating. If you run libevent-based WebSocket services, verify you're on 2.2.2-alpha or later. More importantly, audit your own message reassembly logic regardless of library version — the lesson from this CVE is that the absence of an aggregate limit should be treated as a vulnerability until proven otherwise.

Reviewed through automated stages and approved by a human before publication.