CryptPad version 2025.3.1 contains a vulnerability that allows an unauthenticated remote attacker to flood the WebSocket frames without bounds. This can cause significant degradation or denial of service for all users of the affected CryptPad instance. The issue is fixed in version 2026.2.2.