Off-by-one error in the WebSocketHandshake::readServerHandshake function in websockets/WebSocketHandshake.cpp in WebCore in WebKit before r56380, as used in Qt and other products, allows remote websockets servers to cause a denial of service (memory corruption) or possibly have unspecified other impact via an upgrade header that is long and invalid.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 7, 2010 |
| Suse | — | Upgrade libwebkit-langUpgrade libwebkit-1_0-2-32bitUpgrade libwebkit-develUpgrade libwebkit-1_0-2Upgrade webkit-jsc | Feb 17, 2015 | Jul 22, 2010 |
| Ubuntu | — | Upgrade webkit | Nov 19, 2024 | Jul 22, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub