WebSocket Frame Parsing Vulnerability in XX-Net by XX-Net Team

CVE-2026-10099

What is CVE-2026-10099?

The XX-Net V5.16.6 version contains a vulnerability in the WebSocket_receive_worker routine of simple_http_server.py. This issue arises when the server processes WebSocket frames without validating the MASK bit. As a result, it reads 4 bytes as a masking key, regardless of whether the MASK bit is set, which leads to the incorrect decoding of the payload. This flaw can allow attackers to send unmasked WebSocket frames, causing data corruption when the first 4 bytes are incorrectly treated as a mask, leading to potential exploitation and degradation of application integrity.

References