Tag
#WebSocket
Understanding and Defending Against CVE-2026-15565: A Denial of Service Vulnerability in Undertow
CVE-2026-15565 is a high-severity vulnerability in the Undertow web server that allows remote attackers to cause a Denial of Service (DoS) attack without authentication. This vulnerability affects several Red Hat products and has a CVSS score of 7.5. In this analysis, we will delve into the root cause, attack surface, and exploitation mechanics of this vulnerability, as well as provide guidance on detection and defense.
MCP Python SDK Vulnerability: WebSocket Server Transport Lacks Host/Origin Validation (CVE-2026-59950)
A vulnerability in the deprecated WebSocket server transport of the MCP Python SDK allows unauthenticated attackers to connect and issue JSON-RPC requests. Affected servers are those that expose `mcp.server.websocket.websocket_server` and lack proper authentication or origin validation. The vulnerability has a CVSS score of 7.6.
Critical WebSocket Message Corruption Vulnerability in websocket-driver (CVE-2026-54466)
A critical vulnerability (CVE-2026-54466, CVSS 9.2) exists in the websocket-driver library, allowing for message corruption via abuse of protocol length headers. This issue affects versions < 0.7.5 and has been patched in version 0.7.5. Successful exploitation requires no authentication or user interaction and can lead to incorrect parsing of subsequent payloads. Immediate upgrade to version 0.7.5 is recommended.