CVE-2026-10099: XX-Net V5.16.6 WebSocket Frame Parsing Data Corruption

Technical summary

The vulnerability exists in the WebSocket_receive_worker routine within simple_http_server.py. WebSocket protocol (RFC 6455) requires clients to mask frames and servers to unmask them; the MASK bit in the frame header indicates whether masking was applied. XX-Net V5.16.6 unconditionally consumes 4 bytes as a masking key regardless of the MASK bit state. This causes the first 4 payload bytes to be misinterpreted as a key, the remaining payload to be incorrectly XOR-decoded, and complete absence of validation for RSV bits, opcode integrity, and FIN fragmentation flags. The result is corrupted application data and protocol state violations.

Business impact

Applications relying on XX-Net V5.16.6 for WebSocket communication may receive corrupted data from clients, leading to application errors, incomplete transactions, or data integrity issues. This is particularly concerning in systems where WebSocket frames carry structured or sensitive information. The local attack vector limits exposure in remote-only deployments, but systems accepting untrusted local connections face elevated risk. Data integrity failures could cascade into downstream systems consuming the corrupted payloads.

Affected systems

XX-Net V5.16.6 is affected. Verify against vendor advisories for patched versions and the scope of affected releases. Deployments should check whether they use the vulnerable version and whether they rely on WebSocket functionality for message handling.

Exploitability

This vulnerability requires local access (AV:L) and no privileges or user interaction (PR:N, UI:N), making it exploitable by any local process or user able to send WebSocket frames to the vulnerable server. The simple nature of the flaw—unconditional reading of 4 bytes as a mask key—means reliable reproduction is straightforward. No special conditions or configuration are required. Remote exploitability is not indicated, limiting the threat model to local network access or compromised local processes.

Remediation

Upgrade XX-Net to a patched version that correctly validates the MASK bit before attempting to read the masking key, implements proper RFC 6455 compliance, and adds validation for RSV bits, opcode, and FIN flags. Verify the exact patched version against the vendor's security advisory. Until patching is possible, restrict WebSocket access to trusted local clients only and monitor for unexpected frame parsing errors in application logs.

Patch guidance

Consult the official XX-Net vendor security advisory for the specific patched version number and upgrade path. Test the patched version in a non-production environment to confirm WebSocket functionality and data integrity before rolling out to production systems. Pay particular attention to any systems where WebSocket frames are parsed by downstream components.

Detection guidance

Monitor application logs for WebSocket frame parsing errors, data corruption alerts, or protocol violations. Network-level detection is limited due to the local attack vector (AV:L), but systems processing WebSocket frames should log failed unmask operations and protocol validation failures. Application-level validation of received data integrity and checksums may reveal corruption caused by this flaw. Consider temporary application-level frame validation as a detective control pending patching.

Why prioritize this

Although CVSS 3.1 rates this as MEDIUM (4.0), prioritization depends on your WebSocket use cases and local threat model. If XX-Net serves only trusted local clients or is not deployed in multi-tenant environments, risk is lower. However, if it processes frames from untrusted local sources or handles sensitive data, corruption could have material impact on data integrity and system reliability. The lack of KEV status and remote attack vector argue for standard patch cadence rather than emergency response, but systems handling critical WebSocket communication should address it sooner.

Risk score, explained

CVSS 3.1 score of 4.0 (MEDIUM) reflects: (1) Local attack vector only (AV:L), limiting exposure to attackers with local system access; (2) No privileges or user interaction required (PR:N, UI:N), making it trivial to trigger by any local process; (3) Integrity impact only (I:L), causing data corruption without confidentiality or availability loss; (4) Unified scope (S:U), no privilege escalation; (5) No confidentiality or availability impact (C:N, A:N). The score appropriately reflects a data integrity issue with local-only exploitability.

Frequently asked questions