---
id: CVE-2025-51846
title: CryptPad 2025.3.1 allows unbounded WebSocket frame flood
summary: >-
  CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote,
  unauthenticated attacker can significantly degrade or deny service for all
  users of a CryptPad instance. Fixed in 2026.2.2.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-770
vendor: xwiki
product: cryptpad
affected:
  - 'cryptpad >= 2025.3.1, < 2026.2.2'
patched:
  - cryptpad 2026.2.2
published: '2026-04-30'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-51846'
references:
  - url: >-
      https://github.com/JohnPerifanis/cryptpad-cve-2025-51846-advisory/blob/main/README.md
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: >-
      https://github.com/cryptpad/cryptpad/pull/2239/changes/1e0c06ad8a0c5dab795f85f9730ec2693320c62e
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-119-01.json
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-51846'
    label: 9119a7d8-5eab-497f-8521-727c672e3725
tags:
  - nvd
  - exploit-available
epss: 0.00578
epssPercentile: 0.46085
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/JohnPerifanis/cryptpad-cve-2025-51846-advisory'
  checkedAt: '2026-10-14T13:31:34.732Z'
exploitAvailable: true
ingestedAt: '2026-10-14T13:30:58.484Z'
---

## Overview

CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.

## Affected

- `cryptpad >= 2025.3.1, < 2026.2.2`

## Remediation

Upgrade past the affected range:

- `cryptpad 2026.2.2`