XX‑Net version 5.16.6 contains a WebSocket frame parsing flaw in the WebSocket_receive_worker routine of simple_http_server.py. The code unconditionally reads four bytes as a masking key even when the MASK bit is not set, leading to incorrect XOR decoding of the payload. As a result, the first four bytes of the payload are consumed as a mask key and the remaining data is corrupted. The omission of validation for the RSV bit, opcode, and FIN fragmentation further allows malformed frames to be accepted, potentially disrupting downstream processing. This vulnerability is classified as CWE‑1286.

The flaw applies to installations of XX‑Net that include the simple_http_server.py component in version 5.16.6. No other releases are currently documented as affected. The security mitigations refer to the GitHub commit a68b972a84ed6e52df9f30237cf47493b9231b53, which patches the masking key handling logic.

The CVSS score of 5.1 indicates a moderate severity. The EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. Attackers can construct unmasked WebSocket frames to corrupt data; however, the flaw does not provide a direct path to arbitrary code execution or privilege escalation. The likely attack vector is any network connection to the XX‑Net WebSocket endpoint, which must be reachable by the attacker. Because the issue results in data corruption rather than execution, the primary risk is the integrity of application data and potential service disruption.