PT-2026-44889 · Xx Net · Xx-Net

Yu Sun · Published 2026-05-29 · Updated 2026-05-29 · CVE-2026-10099

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions XX-Net version 5.16.6

Description A WebSocket frame parsing issue exists in the WebSocket receive worker routine of simple http server.py. The server unconditionally reads 4 bytes as a masking key, even if the MASK bit is not set in the frame header. This causes the first 4 bytes of the payload to be consumed as a mask key and the remaining payload to be incorrectly XOR-decoded, leading to corrupted application data. Additionally, the system fails to validate the RSV bit, opcode, and FIN fragmentation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1286

Related Identifiers

CVE-2026-10099

Affected Products

Xx-Net

References · 6

• https://github.com/XX-net/XX-Net/commit/a68b972a84ed6e52df9f30237cf47493b9231b53 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-10099 · Security Note
• https://github.com/XX-net/XX-Net/issues/14169 · Note
• https://github.com/XX-net/XX-Net/pull/14170 · Note
• https://twitter.com/VulmonFeeds/status/2060456070993096991 · Twitter Post
• https://vulncheck.com/advisories/xx-net-websocket-frame-parsing-data-corruption-via-simple-http-server-py · Note