CVE-2026-28412
Denial of Service via Unrestricted WebSocket Connections in Textream
Publication date: 2026-03-02
Last updated on: 2026-03-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fka | textream | to 1.5.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-400 | The product does not properly control the allocation and maintenance of a limited resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the DirectorServer WebSocket server component of the Textream macOS teleprompter app prior to version 1.5.1. The server does not limit the number of concurrent WebSocket connections, allowing an attacker to open many connections simultaneously.
Because the server broadcasts state updates to all connected clients every 100 milliseconds, having a large number of connections causes the server to perform a very high number of send operations on the main thread. This saturates CPU and memory resources, leading to the application freezing and eventually crashing during live sessions.
How can this vulnerability impact me? :
An attacker can exploit this vulnerability by flooding the DirectorServer with a large number of WebSocket connections, which exhausts CPU and memory resources.
This resource exhaustion causes the Textream application to freeze and crash, resulting in denial of service during live teleprompter sessions.
The impact is a loss of availability of the application, disrupting its intended use.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring the number of concurrent WebSocket connections to the DirectorServer component of the Textream application. An unusually high number of WebSocket connections, especially thousands, may indicate an ongoing attack exploiting this vulnerability.
Additionally, observing high CPU and memory usage on the system running Textream during live sessions can be a sign of exploitation, as the server broadcasts state updates every 100 ms to all connected clients, causing resource exhaustion.
Suggested commands to detect this condition include:
- Use network monitoring tools to count WebSocket connections on the relevant port (e.g., using netstat or lsof):
- `netstat -an | grep ESTABLISHED | grep <Textream_port>` to list established connections.
- `lsof -i :<Textream_port>` to list open connections on the Textream port.
- Use system monitoring tools to check CPU and memory usage:
- `top` or `htop` to monitor CPU and memory usage in real time.
- `ps aux | grep Textream` to check resource usage by the Textream process.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the Textream application to version 1.5.1 or later, where the vulnerability is fixed by enforcing a maximum limit of 5 concurrent WebSocket connections.
If upgrading is not immediately possible, consider limiting the number of concurrent WebSocket connections at the network or firewall level to prevent resource exhaustion.
Additional mitigation includes monitoring and blocking suspicious IP addresses that open excessive WebSocket connections.
The patch also improves broadcast efficiency and restricts broadcasts to authenticated clients, so applying the official fix is the most effective solution.