Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
XX-Net V5.16.6 contains a WebSocket frame parsing vulnerability in the WebSocket_receive_worker routine of simple_http_server.py that allows attackers to cause corrupted application data by sending unmasked WebSocket frames. The server unconditionally reads 4 bytes as a masking key regardless of whether the MASK bit is set in the frame header, causing the first 4 bytes of payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, resulting in data corruption alongside missing RSV bit, opcode, and FIN fragmentation validations.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-10099 WebSocket Frame Parsing Vulnerability in XX-Net V5.16.6 Causes Data Corruption https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-10099
Post summary
A disclosure noting a WebSocket frame parsing flaw in XX‑Net V5.16.6 that results in data corruption, without additional exploitation or patch information.