CVE-2025-66902
BaseFortify
Publication date: 2026-01-20
Last updated on: 2026-01-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pithikos | websocket_server | 0.6.4 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an input validation flaw in the websocket-server Python package version 0.6.4. Specifically, in the websocket_server/websocket_server.py file, the WebSocketServer._message_received method does not properly validate incoming client messages before processing them. Messages are decoded and passed directly to JSON parsing without checks for input size, format, schema, or robust exception handling. This allows a remote attacker to send malformed or specially crafted payloads that can cause server-side exceptions, unexpected or unstable server behavior, and potentially expose sensitive internal error information depending on server configuration. [1]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability affects compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing a remote attacker to cause unexpected or unstable behavior on your WebSocket server, potentially leading to denial of service or server crashes. Additionally, it may expose sensitive internal error information that could be leveraged for further attacks or information disclosure. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by sending specially crafted WebSocket messages to the websocket-server version 0.6.4 and observing the server's behavior for exceptions or unexpected responses. Using the proof of concept scripts available in the repository cyberinvest211/websocket-server-vuln-poc, you can run the client script (poc.py) to send malformed payloads to the server and check if it triggers errors or exposes sensitive information. Monitoring server logs for exceptions related to JSON parsing in the WebSocketServer._message_received method can also help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable websocket-server, implementing network-level controls such as firewalls or access control lists to limit client connections, and monitoring for suspicious WebSocket traffic. Since no official fix is available, avoid exposing the vulnerable server to untrusted networks. Additionally, review and enhance input validation in the WebSocket server code to include size limits, format and schema validation, and robust exception handling to prevent malformed inputs from causing server instability. [1]