Corvusoft restbed versions up to 5.0.0 contain a vulnerability where WebSocket frames with extremely large declared payload sizes (up to 2^63 bytes) are accepted and buffered without limits in an unbounded stream buffer. This lack of throttling or resource allocation limits enables remote unauthenticated attackers to exhaust server memory by sending large payloads, resulting in denial of service through process crash. The CVSS 4.0 score is 8.7, indicating high severity with network attack vector, no privileges or user interaction required, and high impact on availability.

Remote unauthenticated attackers can cause denial of service by exhausting server memory through sending WebSocket frames with large declared payload sizes. This leads to process crashes and service unavailability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider implementing external protections such as WebSocket frame size limits or rate limiting at network or proxy layers to mitigate potential exploitation.