PatchSiren cyber security CVE debrief
CVE-2026-10099 XX-net CVE debrief
A WebSocket frame parsing vulnerability in XX-Net V5.16.6 allows attackers to cause data corruption by sending unmasked WebSocket frames. The `WebSocket_receive_worker` routine in `simple_http_server.py` unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header. This causes the first 4 bytes of payload to be consumed as a mask key, with remaining payload incorrectly XOR-decoded. The vulnerability also involves missing validations for RSV bits, opcode, and FIN fragmentation. The issue was disclosed on 2026-05-29 with a CVSS 4.0 score of 5.1 (MEDIUM). A fix commit and pull request are available.
- Vendor
- XX-net
- Product
- Unknown
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-05-29
- Original CVE updated
- 2026-05-29
- Advisory published
- 2026-05-29
- Advisory updated
- 2026-05-29
Who should care
Organizations running XX-Net V5.16.6 or earlier versions; developers implementing custom WebSocket servers based on XX-Net code; security teams monitoring for RFC 6455 compliance issues in WebSocket implementations
Technical summary
The vulnerability exists in the `WebSocket_receive_worker` function within `simple_http_server.py` in XX-Net V5.16.6. The implementation fails to check the MASK bit (bit 0 of the second byte) in the WebSocket frame header before attempting to read a 4-byte masking key. For unmasked frames (MASK=0), this causes the parser to consume the first 4 bytes of actual payload data as if they were a masking key, then incorrectly apply XOR decoding to the remaining payload bytes using these misinterpreted values. Additionally, the implementation lacks validation for reserved RSV bits, opcode correctness, and FIN fragmentation handling as required by RFC 6455. This results in corrupted application data rather than confidentiality or availability impacts.
Defensive priority
medium
Recommended defensive actions
- Review and apply the fix commit referenced in the advisory to XX-Net deployments
- Validate WebSocket frame parsing logic in any custom implementations of RFC 6455
- Implement proper MASK bit validation before reading masking key bytes
- Add validation for RSV bits, opcode validity, and FIN fragmentation as per RFC 6455
- Monitor for anomalous WebSocket traffic patterns that may indicate exploitation attempts
Evidence notes
Vulnerability disclosed via Vulncheck advisory with GitHub commit, issue, and pull request references. CVSS 4.0 vector provided in NVD source. CWE-1286 (Improper Validation of Syntactic Correctness of Input) identified as primary weakness.
Official resources
2026-05-29