CVE-2026-10099: XX-Net V5.16.6 XSS Vulnerability

CVE-2026-10099 Overview

CVE-2026-10099 is a WebSocket frame parsing flaw in XX-Net V5.16.6. The vulnerability resides in the WebSocket_receive_worker routine of simple_http_server.py. The server unconditionally reads four bytes as a masking key regardless of the MASK bit state in the frame header. This causes the first four bytes of payload to be consumed as a mask key, then the remaining payload is incorrectly XOR-decoded. The result is corrupted application data when clients send unmasked WebSocket frames. The implementation also omits validation of RSV bits, opcode values, and FIN fragmentation, deviating from RFC 6455. The issue is categorized under [CWE-1286] (Improper Validation of Syntactic Correctness of Input).

Critical Impact
Attackers with local access can trigger data corruption in WebSocket-handled application data by transmitting unmasked frames to the XX-Net HTTP server component.

Affected Products

XX-Net V5.16.6
simple_http_server.py WebSocket handler
Earlier versions sharing the same WebSocket_receive_worker implementation

Discovery Timeline

2026-05-29 - CVE-2026-10099 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10099

Vulnerability Analysis

The WebSocket protocol defined in RFC 6455 requires clients to mask all frames sent to a server. A frame header bit named MASK signals whether a 4-byte masking key follows the payload length field. XX-Net's WebSocket_receive_worker function ignores this control bit. The handler reads four bytes from the socket regardless of MASK state and treats them as the key.

When a client sends an unmasked frame, the first four payload bytes are incorrectly stripped and reinterpreted as a masking key. The handler then XORs the remaining payload against those bytes, producing garbled application data. The decoded buffer no longer matches what the sender transmitted. Downstream consumers of the WebSocket stream act on corrupted input.

The same routine also lacks input validation for reserved (RSV) bits, opcode values, and FIN fragmentation handling. Malformed control frames and continuation frames are not rejected. This expands the parsing inconsistency surface beyond the masking defect.

Root Cause

The root cause is missing conditional logic around the masking key read. The handler should only consume the masking key bytes when the MASK bit is set, and reject server-bound frames that arrive unmasked. The implementation hard-codes the key read, violating frame syntax validation rules captured by [CWE-1286].

Attack Vector

Exploitation requires local network access to the XX-Net WebSocket listener and the ability to send raw WebSocket frames. The CVSS 4.0 vector identifies the attack vector as Local with low complexity and no privileges or user interaction. The impact is limited to integrity of WebSocket-delivered data. There is no confidentiality or availability impact recorded, and the EPSS score is 0.021% (percentile 5.96), indicating a low likelihood of active exploitation.

The vulnerability mechanism is documented in the VulnCheck Security Advisory and the upstream GitHub Issue Discussion.

Detection Methods for CVE-2026-10099

Indicators of Compromise

Unexpected application errors or decoding failures originating from XX-Net WebSocket sessions on simple_http_server.py.
Inbound WebSocket frames where the MASK bit is cleared but a payload still follows.
Mismatched payload lengths between sender logs and XX-Net server-side processing logs.

Detection Strategies

Inspect WebSocket traffic to the XX-Net listener and flag frames lacking the MASK bit per RFC 6455.
Audit XX-Net process logs for parsing exceptions, malformed frame warnings, or downstream consumer errors tied to WebSocket input.
Compare deployed XX-Net commit hashes against the fixed revision referenced in the GitHub Commit Description.

Monitoring Recommendations

Capture WebSocket protocol telemetry on hosts running XX-Net and alert on unmasked client-to-server frames.
Monitor integrity of data passing through WebSocket pipelines by enabling application-layer checksums or sequence validation.
Track installed XX-Net versions across endpoints and flag instances on V5.16.6 or earlier.

How to Mitigate CVE-2026-10099

Immediate Actions Required

Upgrade XX-Net to the build incorporating the fix from GitHub Pull Request 14170.
Restrict access to the XX-Net WebSocket interface to trusted local processes only.
Validate that no production data flows depend on the WebSocket endpoint until patching is complete.

Patch Information

The maintainers addressed the parsing flaw in commit a68b972a84ed6e52df9f30237cf47493b9231b53. The fix introduces conditional handling of the masking key based on the MASK bit and adds validation for RSV bits, opcode values, and FIN fragmentation. Review the GitHub Commit Description for code-level details.

Workarounds

Disable the WebSocket handler in simple_http_server.py if it is not required by deployed XX-Net features.
Bind the XX-Net listener to the loopback interface to prevent non-local frame delivery.
Place a compliant WebSocket proxy in front of XX-Net to enforce RFC 6455 framing rules and reject unmasked client frames.

bash

# Configuration example
# Verify installed XX-Net commit and update to the fixed revision
git -C /opt/XX-Net rev-parse HEAD
git -C /opt/XX-Net pull --ff-only
git -C /opt/XX-Net log --oneline | grep a68b972a84ed6e52df9f30237cf47493b9231b53