CVE-2022-35922

A vulnerability was found in rust-websocket, where untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The issue occurs during dataframe parsing. A buffer would be allocated based on the declared dataframe size, which may come from an untrusted source. When Vec::with_capacity fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use with_capacity, hence, a denial of service can only happen when bytes for oversized dataframe or message actually got delivered by the attacker.