CVE-2022-35922

Rust-WebSocket is a WebSocket (RFC6455) library written in Rust. In versions prior to 0.26.5 untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When `Vec::with_capacity` fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use `with_capacity`, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker. The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version. Users unable to upgrade are advised to filter websocket traffic externally or to only accept trusted traffic.

• CWE-400
• CWE-770

• https://github.com/websockets-rs/rust-websocket/commit/cbf6e9983e839d2ecad86de8cd1b3f20ed43390bPatch, Third Party Advisory
• https://github.com/websockets-rs/rust-websocket/security/advisories/GHSA-qrjv-rf5q-qpxcThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V2EOOU5OLEHVMKAH6BALQXKDKIZRXCI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYPNCM4H4OFBIZI6XMJ2DUTS54FT2TWP/
• https://github.com/websockets-rs/rust-websocket/commit/cbf6e9983e839d2ecad86de8cd1b3f20ed43390bPatch, Third Party Advisory
• https://github.com/websockets-rs/rust-websocket/security/advisories/GHSA-qrjv-rf5q-qpxcThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4V2EOOU5OLEHVMKAH6BALQXKDKIZRXCI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HYPNCM4H4OFBIZI6XMJ2DUTS54FT2TWP/

Published

Aug 1, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-35917Solana Pay is a protocol and set of reference implementation…5.3
• CVE-2022-35918Streamlit is a data oriented application development framewo…6.5
• CVE-2022-35919MinIO is a High Performance Object Storage released under GN…2.7
• CVE-2022-3592A symlink following vulnerability was found in Samba, where …6.5
• CVE-2022-35920Sanic is an opensource python web server/framework. Affected…7.5
• CVE-2022-35921fof/byobu is a private discussions extension for Flarum foru…4.3
• CVE-2022-35923v8n is a javascript validation library. Versions of v8n prio…7.5
• CVE-2022-35924NextAuth.js is a complete open source authentication solutio…9.1
• CVE-2022-35925BookWyrm is a social network for tracking reading. Versions …9.8
• CVE-2022-35926Contiki-NG is an open-source, cross-platform operating syste…7.5
• CVE-2022-35927Contiki-NG is an open-source, cross-platform operating syste…9.8
• CVE-2022-35928AES Crypt is a file encryption software for multiple platfor…5.5