CVE-2026-28412

Katalog CVE

CVSS 7.5 · High EPSS 0,40%

Kerentanan Uncontrolled Resource Consumption pada fka textream. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the `DirectorServer` WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session. Version 1.5.1 fixes the issue.

Rincian

Terbit di NVD

2 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/f/textream/security/advisories/GHSA-qr5p-7x47-qxh9 exploit · advisory vendor
• https://github.com/f/textream/commit/3524fa96f98ba17025b48ce9e19d49d859fc2ec1 patch