CVE-2026-123748 in grok2api
Summary
by MITRE • 11/06/2026
A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
A critical resource consumption vulnerability has been identified within the chenyme grok2api software, specifically affecting versions up through 3.1.6. This flaw resides in the proxyVoiceWebSocket function located in the backend/internal/transport/http/inference/voice_ws_handler.go file of the WebSocket Proxy component. The nature of this defect allows an attacker to trigger excessive resource utilization on the target system by manipulating input data sent via the WebSocket interface. Because the vulnerability is exploitable remotely, it presents a significant risk to services that expose this endpoint to untrusted networks or the public internet without adequate protective measures such as rate limiting or strict authentication controls.
The technical root cause of this issue lies in how the proxyVoiceWebSocket function handles incoming connections and data streams from clients. When an attacker sends specifically crafted requests, the application fails to properly limit resource allocation for these sessions. This lack of effective input validation and resource management leads to a state where system resources such as memory or CPU cycles are consumed at rates disproportionate to normal operational needs. In security taxonomy terms, this aligns with CWE-400, which describes uncontrolled resource consumption, often referred to in the context of denial-of-service attacks. The vulnerability enables an attacker to degrade service availability by exhausting server capacity, potentially causing legitimate users to experience latency or complete service outages.
From a tactical perspective, this vulnerability maps directly to MITRE ATT&CK technique T1498, Network Denial of Service, specifically the sub-technique related to resource exhaustion via volumetric attacks. The remote exploitability means that an adversary does not need prior access credentials if the WebSocket endpoint is publicly accessible or if authentication mechanisms are weak or bypassable. Even with authentication in place, a compromised account could be used to launch this attack against other users or infrastructure components sharing the same resources. The impact extends beyond simple downtime; it can lead to increased operational costs due to cloud resource scaling triggers and potential data integrity issues if services crash unexpectedly during critical processing tasks.
To mitigate this risk, immediate action is required by upgrading the chenyme grok2api component to version 3.1.7 or later. The developers have addressed this flaw in patch identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4, which implements proper resource limits and validation checks within the proxyVoiceWebSocket function. Organizations should verify their current version against the affected range and apply the update through standard deployment pipelines. In addition to upgrading, it is recommended to implement network-level protections such as Web Application Firewalls with rate-limiting rules for WebSocket endpoints. This adds a layer of defense-in-depth by throttling excessive connection attempts before they can exhaust server resources. Regular security audits and penetration testing should also be conducted to ensure that similar resource management flaws are not present in other parts of the application architecture.