ETK-2026-1840Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-1840",
  "cve_id": null,
  "display_id": "ETK-2026-1840",
  "ghsa_id": "GHSA-m6j5-42w4-55c3",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Unauthenticated memory-exhaustion denial of service in go-httpbin",
  "summary": "go-httpbin versions before v2.26.0 are affected by unbounded allocation while parsing WebSocket frame lengths. An unauthenticated remote client able to reach the WebSocket endpoint can cause process termination through memory exhaustion, disrupting all requests handled by that instance.",
  "mitigation": "Upgrade github.com/mccutchen/go-httpbin/v2 to v2.26.0 or later. Restrict untrusted access to the WebSocket endpoint until the upgrade is deployed.",
  "vendor": "go",
  "product": "go:github.com/mccutchen/go-httpbin/v2",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= v2.13.0, < v2.26.0"
      ],
      "ecosystem": "go",
      "fixed_versions": [
        "v2.26.0"
      ],
      "package_name": "github.com/mccutchen/go-httpbin/v2",
      "purl": "pkg:golang/github.com/mccutchen/go-httpbin/v2"
    }
  ],
  "cwes": [
    789
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 19.327504716666667,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-17T04:00:24.025572+00:00",
      "days": -4.359347990092592,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T12:37:51.714503+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-15T10:36:52+00:00",
      "days": -6.084024211990741,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T12:37:51.714503+00:00",
      "url": "https://github.com/mccutchen/go-httpbin/security/advisories/GHSA-m6j5-42w4-55c3"
    }
  }
}