A critical vulnerability in CryptPad allows remote, unauthenticated attackers to trigger a denial of service condition via an unbounded WebSocket frame flood.

This issue is a resource exhaustion flaw (CWE-770) where the application fails to limit or throttle WebSocket frames. A remote, unauthenticated attacker can exploit this to flood the server and degrade or completely deny service to legitimate users.

The ability for an unauthenticated attacker to remotely disrupt service availability presents a significant operational risk. Given the CVSS score of 7.5, this high severity vulnerability could lead to prolonged system downtime, hindering collaborative workflows and potentially causing reputational damage for organizations relying on CryptPad for secure communication.

Immediate Action: Update the CryptPad instance to version 2026.2.2 or later immediately to implement the required resource throttling.

Proactive Monitoring: Monitor server resource utilization and WebSocket connection logs for sudden, high volumes of traffic from singular or suspicious sources that could indicate a flood attack.

Compensating Controls: Deploy a Web Application Firewall or load balancer capable of rate-limiting WebSocket traffic and enforcing connection limits to mitigate the impact of flooding attempts.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository referenced in the enrichment data.

The vulnerability poses a clear threat to service availability and should be addressed as a priority. Administrators must apply the version 2026.2.2 update immediately to neutralize the risk of WebSocket-based denial of service attacks. If an immediate update is not feasible, ensure that network-level rate limiting is active to protect the instance from abuse.