CryptPad 2025.3.1 is vulnerable to an unbounded WebSocket frame flood that allows a remote, unauthenticated attacker to send unlimited frames to the server. This can make the system resource‑hungry and severely degrade or deny real‑time collaboration service for all users, effectively causing a denial of service. The flaw is a classic instance of the CWE‑770 weakness—unbounded resource consumption.

The affected product is CryptPad for all instances running up to and including version 2025.3.1; the issue is resolved in version 2026.2.2 and later. All deployments not yet updated to the fixed release are susceptible.

The CVSS rating of 8.7 indicates high severity because the vulnerability does not require authentication and can be triggered from any network-connected client that can establish a WebSocket connection. The EPSS score is not available, and the flaw is not listed in CISA KEV, so the current exploitation probability is unknown, but the potential impact remains significant. An attacker can exploit the server by flooding it with large numbers of WebSocket frames, exhausting memory or CPU resources and forcing the instance to become unresponsive for all users.