Skip to content
OpenAdvisories
High VA-26-119-01 1 CVE

CryptPad unbounded WebSocket frame flood

Published Apr 29, 2026 · Updated Apr 29, 2026

Vendor: cryptpad Product: cryptpad

Summary

CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance.

Vulnerabilities 1

  • High 7.5
    CVE-2025-51846 Public exploit

    CryptPad unbounded WebSocket frame flood

    CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.

    cryptpad cryptpad

Revision history

  1. #1.0.0

    Initial publication