The vulnerability arises from the WebSocket implementation in restbed versions up to 5.0.0, which accepts frames with declared payload lengths as large as 2^63 bytes. The application buffers the payload without enforcing a size limit, allowing a remote unauthenticated attacker to stream data that exhausts the server's memory and ultimately causes the process to crash. This behavior is a classic case of uncontrolled resource consumption, classified as CWE‑770, and results in a denial of service of the affected service.

The affected product is Corvusoft restbed, specifically all releases through version 5.0.0. These versions lack any mechanism to cap the size of incoming WebSocket frames.

The CVSS score of 8.7 reflects a high severity due to the ease of exploitation and significant impact on availability. The EPSS score is not available and the flaw is not listed in CISA’s KEV catalog. Attackers need only establish a WebSocket connection and send large frame sizes; no authentication is required. Successful exploitation leads to memory exhaustion, file descriptor depletion, and finally a service crash that disrupts normal operation.