CyberRota Analysis
AI-GeneratedThe websocket-driver library for Java is vulnerable to a flaw in the WebSocket protocol's frame format, allowing an attacker to send an indefinite sequence of bytes that can cause the server to parse an ever-growing integer, leading to potential payload misinterpretation. This vulnerability can result in unexpected behavior or application crashes due to the loss of precision in JavaScript number handling. Developers and organizations using versions prior to 0.7.5 should prioritize upgrading to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.
Related CVEs
Other vulnerabilities affecting the same vendor(s)