CVE-2026-97152 - Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf

Back Back to CVE browser

HIGH

Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf

Published Sep 24, 2026

8.6

HIGH

CVSS 4.0

EPSS 0.31%

Description

Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf.

Affected products

Vendor Nanomsg Product Nanomsg Default
unaffected
- Version
  0.5.0
  Status
  affected
  Constraints
  <1.2.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Nanomsg

unaffected

Version	Status	Constraints
0.5.0	affected	<1.2.3

Remediation

Vendor solution

Upgrade to nanomsg 1.2.3 or higher, or use NNG which is hardened for hostile networks.

Weaknesses (1)

CWE-122

References (3)

Link	Providers	Tags
https://github.com/nanomsg/nanomsg/pull/1130
https://github.com/nanomsg/nanomsg/releases/tag/1.2.3
https://nanomsg.org

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Sep 24, 2026

Updated Sep 24, 2026

Reserved Sep 24, 2026

Link CVE-2026-97152

CISA Vulnrichment

Updated Sep 24, 2026

NVD

Status Received

Modified Sep 24, 2026

Link CVE-2026-97152

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-97152