{"id":"CVE-2026-10099","aliases":[],"cve":{"records":[{"id":"CVE-2026-10099","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-29T15:03:52.130Z","published":"2026-05-29T15:58:24.062Z","modified":"2026-11-08T14:00:37.358Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T14:00:37.358Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-06-01T15:24:15.120Z"}],"references":[{"url":"https://github.com/XX-net/XX-Net/issues/14169","tags":["issue-tracking"],"source":"VulnCheck"},{"url":"https://github.com/XX-net/XX-Net/pull/14170","tags":["issue-tracking","patch"],"source":"VulnCheck"},{"url":"https://github.com/XX-net/XX-Net/commit/a68b972a84ed6e52df9f30237cf47493b9231b53","tags":["patch"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/xx-net-websocket-frame-parsing-data-corruption-via-simple-http-server-py","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-1286","description":"CWE-1286 – Improper Validation of Syntactic Correctness of Input","source":"VulnCheck"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-06-01T15:24:05.941612Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption via simple_http_server.py","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header, causing the first 4 bytes of payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, resulting in data corruption alongside missing RSV bit, opcode, and FIN fragmentation validations.","score":5.1,"severity":"medium","published":"2026-05-29T15:58:24.062Z","modified":"2026-11-08T14:00:37.358Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"XX-net","name":"XX-Net","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"5.16.6","versionType":"git"},{"version":"0","status":"affected","lessThanOrEqual":"43aec6f","versionType":"git"}],"defaultStatus":"unknown","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-10099"}],"remediation":[],"references":["https://github.com/XX-net/XX-Net/issues/14169","https://github.com/XX-net/XX-Net/pull/14170","https://github.com/XX-net/XX-Net/commit/a68b972a84ed6e52df9f30237cf47493b9231b53","https://www.vulncheck.com/advisories/xx-net-websocket-frame-parsing-data-corruption-via-simple-http-server-py"],"sources":[{"name":"CVE","id":"CVE-2026-10099","modified":"2026-11-08T14:00:37.358Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-10099"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":4},{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.1}],"sourceAffected":[],"observedAt":"2026-11-08T14:07:33.688Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T02:00:33.565Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-09T08:00:47.717Z","attemptedAt":"2026-11-09T08:00:47.717Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-09T08:00:36.374Z","attemptedAt":"2026-11-09T08:00:36.374Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-09T08:00:36.620Z","attemptedAt":"2026-11-09T08:00:36.620Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-09T08:00:35.667Z","attemptedAt":"2026-11-09T08:00:35.667Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-10099","url":"https://www.first.org/epss/","probability":0.00125,"percentile":0.0221,"date":"2026-11-08","checkedAt":"2026-11-09T08:00:35.667Z"},{"source":"GitHub Advisory Database","id":"GHSA-cwjv-w927-x7gr","url":"https://github.com/advisories/GHSA-cwjv-w927-x7gr","modified":"2026-05-29T18:31:42Z","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T08:00:36.374Z"},{"source":"ENISA EUVD","id":"EUVD-2026-33346","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-33346","modified":"Nov 8, 2026, 2:00:37 PM","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-09T08:00:36.620Z"},{"source":"NVD","id":"CVE-2026-10099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10099","modified":"2026-10-06T22:10:00.247","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-09T08:00:47.717Z"},{"source":"NVD","id":"CVE-2026-10099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10099","modified":"2026-10-06T22:10:00.247","score":4,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","checkedAt":"2026-11-09T08:00:47.717Z"}],"aiSummary":{"text":"XX-Net V5.16.6 has a WebSocket frame parsing vulnerability, allowing attackers to cause data corruption by sending unmasked frames. The server incorrectly reads the frame header, leading to data corruption. Attackers need access to the WebSocket connection.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T14:16:04.465Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-10099"}]}}