CVE-2025-51846
Published: 30 April 2026
Summary
CVE-2025-51846 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Xwiki Cryptpad. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Direct Network Flood (T1498.001); ranked in the top 28.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements denial-of-service protections such as rate limiting or throttling to prevent unbounded WebSocket frame floods from causing resource exhaustion.
Requires timely identification, reporting, and correction of flaws like the unbounded WebSocket frame handling vulnerability in CryptPad.
Protects system resource availability from degradation due to excessive consumption by unauthenticated WebSocket frame flood attacks.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct mapping to network DoS via unbounded WebSocket frame flooding (CWE-770 resource exhaustion).
NVD Description
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.
Deeper analysisAI
CVE-2025-51846 is an unbounded WebSocket frame flood vulnerability (CWE-770) affecting CryptPad version 2025.3.1. This flaw enables resource exhaustion due to a lack of limits or throttling on incoming WebSocket frames, published on 2026-04-30 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction or privileges required. Successful exploitation significantly degrades performance or fully denies service to all users of the affected CryptPad instance by flooding it with WebSocket frames.
The vulnerability is addressed in CryptPad version 2026.2.2. Mitigation details appear in the advisory at https://github.com/JohnPerifanis/cryptpad-cve-2025-51846-advisory/blob/main/README.md, the fixing pull request at https://github.com/cryptpad/cryptpad/pull/2239/changes/1e0c06ad8a0c5dab795f85f9730ec2693320c62e, CISA's CSAF document at https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-119-01.json, and the official CVE record at https://www.cve.org/CVERecord?id=CVE-2025-51846.
Details
- CWE(s)