The vulnerability resides in the proxyVoiceWebSocket handler of the WebSocket Proxy component in chenyme grok2api. An attacker can craft a malicious WebSocket request that forces the server to allocate excessive resources, leading to memory or CPU exhaustion. The resulting denial of service limits the availability of the application to legitimate users. This shortage of resources is a consequence of improper input validation and missing resource checks, corresponding to CWE-400 and CWE-404.

All releases of chenyme grok2api up to and including version 3.1.6 are affected. The vulnerable code is located in backend/internal/transport/http/inference/voice_ws_handler.go. The issue is fixed starting with version 3.1.7, which incorporates patch commit 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4.

The CVSS base score of 5.3 indicates a moderate severity for resource exhaustion. No EPSS score is available, so the precise likelihood of exploitation remains unknown. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is remote – an attacker only needs to establish a WebSocket connection – systems exposed to the internet face a higher risk. Immediate remediation is advisable to prevent potential denial of service incidents.