https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 22:01:48 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-102761 <p>NetX Duo&#39;s WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop&#39;s upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet&#39;s unused payload area and on through the second packet&#39;s `NX_PACKET` control block.</p> <p>The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.</p> <p>NetX Duo&#39;s WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop&#39;s upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet&#39;s unused payload area and on through the second packet&#39;s `NX_PACKET` control block.</p> <p>The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-102761 https://vulnerability.circl.lu/vuln/ghsa-mjm4-7228-hgjf <p>NetX Duo&#39;s WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop&#39;s upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet&#39;s unused payload area and on through the second packet&#39;s `NX_PACKET` control block.</p> <p>The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.</p> <p>NetX Duo&#39;s WebSocket client resets the unmasking cursor to the first `NX_PACKET` each time it advances through a chained packet, while the loop&#39;s upper bound belongs to the current packet. With the standard contiguous packet-pool layout, a masked server frame split across two packets therefore drives the XOR loop through the first packet&#39;s unused payload area and on through the second packet&#39;s `NX_PACKET` control block.</p> <p>The four-byte WebSocket masking key controls the bytes written, so the corruption is attacker-chosen rather than incidental.</p> https://vulnerability.circl.lu/vuln/ghsa-mjm4-7228-hgjf