{"id":"CVE-2026-100403","kind":"vulnerability","aliases":["CVE-2026-100403"],"related":[],"title":"BACnet Stack: unbounded WebSocket fragment buffer lets a peer exhaust memory","description":"BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.6, 1.5.2, and 1.6.1, the BACnet/SC hub's Linux WebSocket server reassembles fragmented WebSocket messages into a per-connection fragment_buffer. It grows that buffer with realloc() on every non-final frame, with no upper bound. A peer that streams binary continuation fragments and never sets FIN keeps the hub reallocating until the box runs out of memory or the process is OOM-killed. The buffer starts at the maximum legal BVLC-SC NPDU size, but nothing after that ties its growth back to that limit. This issue has been patched in versions 1.4.6, 1.5.2, 1.6.1, and 1.7.0.","summary":"The BACnet/SC hub's Linux WebSocket server keeps growing a per-connection buffer for fragmented messages with no upper limit. A remote peer that sends continuation frames without ever setting FIN can exhaust memory and get the process OOM-killed.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"BACnet Stack","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["bacnet","bacnet-sc","c","embedded","linux","package"],"not_affected_if":["non-hub-deployments"],"how_to_check":"- Check the BACnet Stack version in use, for example by inspecting the vendored library or `git describe` in the source tree.\n- Confirm whether the BACnet/SC hub's Linux WebSocket server is built and running.","fix":"- Move to `1.4.6`, `1.5.2`, `1.6.1`, or `1.7.0`, depending on the release line in use.","status":"open","published_at":"2026-11-13T19:17:36+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","triaged_at":"2026-11-13T19:54:08+00:00","updated_at":"2026-11-13T19:54:08+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T19:54:08Z","model":"claude-haiku-5-5","output":{"fix":"- Move to `1.4.6`, `1.5.2`, `1.6.1`, or `1.7.0`, depending on the release line in use.","reach":"network","title":"BACnet Stack: unbounded WebSocket fragment buffer lets a peer exhaust memory","impact":"medium","summary":"The BACnet/SC hub's Linux WebSocket server keeps growing a per-connection buffer for fragmented messages with no upper limit. A remote peer that sends continuation frames without ever setting FIN can exhaust memory and get the process OOM-killed.","audience":"developers","category":"package","nicknames":[],"who_cares":["bacnet","bacnet-sc","embedded","linux","c"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Remote peer exhausts memory and crashes the hub process","analyst_note":"","how_to_check":"- Check the BACnet Stack version in use, for example by inspecting the vendored library or `git describe` in the source tree.\n- Confirm whether the BACnet/SC hub's Linux WebSocket server is built and running.","plain_action":"","product_name":"BACnet Stack","needs_analyst":false,"not_affected_if":["non-hub-deployments"],"who_is_affected":"Teams that build or run the BACnet/SC hub on Linux using the BACnet Stack C library are exposed, since the flaw is in the hub's WebSocket server code. Systems using other BACnet components or unaffected release lines can skip it, though the sources do not list which configurations are not exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000766,"input_tokens":4724,"output_tokens":588,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-100403':14A,17A '-2026':13A,16A '1.4.6':87C,184C '1.5.2':88C,185C '1.6.1':90C,186C '1.7.0':188C 'back':173C 'bacnet':1A,18A,20B,22B,70C,74C 'bacnet-sc':21B 'bacnet/sc':29B,92C 'binari':129C 'bound':124C 'box':142C 'buffer':6A,41B,108C,112C,155C 'bvlc':162C 'bvlc-sc':161C 'c':24B,79C 'connect':40B,106C 'continu':54B,130C 'cve':12A,15A 'embed':25B,82C 'ever':57B 'everi':116C 'exhaust':10A,61B 'fin':59B,135C 'final':119C 'fragment':5A,43B,99C,107C,131C 'frame':55B,120C 'get':64B 'grow':36B,110C 'growth':172C 'hub':30B,93C,138C 'issu':178C 'keep':35B,136C 'kill':69B,153C 'legal':160C 'let':7A 'librari':80C 'limit':48B,176C 'linux':26B,32B,95C 'maximum':159C 'memori':11A,62B,146C 'messag':44B,101C 'never':133C 'non':118C 'non-fin':117C 'noth':167C 'npdu':164C 'oom':68B,152C 'oom-kil':67B,151C 'open':75C 'packag':27B 'patch':181C 'peer':9A,51B,126C 'per':39B,105C 'per-connect':38B,104C 'prior':84C 'process':66B,149C 'protocol':77C 'realloc':114C,139C 'reassembl':98C 'remot':50B 'run':143C 'sc':23B,163C 'send':53B 'server':34B,97C 'set':58B,134C 'size':165C 'sourc':76C 'stack':2A,19A,71C,78C 'start':156C 'stream':128C 'system':83C 'tie':170C 'unbound':3A 'upper':47B,123C 'version':86C,183C 'websocket':4A,33B,96C,100C 'without':56B","nicknames":[],"mitigations":[],"who_affected":"Teams that build or run the BACnet/SC hub on Linux using the BACnet Stack C library are exposed, since the flaw is in the hub's WebSocket server code. Systems using other BACnet components or unaffected release lines can skip it, though the sources do not list which configurations are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["bacnetstack","stack"],"ptokens":["bacnet","stack"],"labels":["bacnet","bacnetsc","c","embedded","high","linux","package","vendor"],"campaign_type":null,"search_a":"'-100403':14A,17A '-2026':13A,16A 'bacnet':1A,18A 'buffer':6A 'cve':12A,15A 'exhaust':10A 'fragment':5A 'let':7A 'memori':11A 'peer':9A 'stack':2A,19A 'unbound':3A 'websocket':4A","search_b":"'bacnet':20B,22B 'bacnet-sc':21B 'bacnet/sc':29B 'buffer':41B 'c':24B 'connect':40B 'continu':54B 'embed':25B 'ever':57B 'exhaust':61B 'fin':59B 'fragment':43B 'frame':55B 'get':64B 'grow':36B 'hub':30B 'keep':35B 'kill':69B 'limit':48B 'linux':26B,32B 'memori':62B 'messag':44B 'oom':68B 'oom-kil':67B 'packag':27B 'peer':51B 'per':39B 'per-connect':38B 'process':66B 'remot':50B 'sc':23B 'send':53B 'server':34B 'set':58B 'upper':47B 'websocket':33B 'without':56B","search_c":"'1.4.6':87C,184C '1.5.2':88C,185C '1.6.1':90C,186C '1.7.0':188C 'back':173C 'bacnet':70C,74C 'bacnet/sc':92C 'binari':129C 'bound':124C 'box':142C 'buffer':108C,112C,155C 'bvlc':162C 'bvlc-sc':161C 'c':79C 'connect':106C 'continu':130C 'embed':82C 'everi':116C 'fin':135C 'final':119C 'fragment':99C,107C,131C 'frame':120C 'grow':110C 'growth':172C 'hub':93C,138C 'issu':178C 'keep':136C 'kill':153C 'legal':160C 'librari':80C 'limit':176C 'linux':95C 'maximum':159C 'memori':146C 'messag':101C 'never':133C 'non':118C 'non-fin':117C 'noth':167C 'npdu':164C 'oom':152C 'oom-kil':151C 'open':75C 'patch':181C 'peer':126C 'per':105C 'per-connect':104C 'prior':84C 'process':149C 'protocol':77C 'realloc':114C,139C 'reassembl':98C 'run':143C 'sc':163C 'server':97C 'set':134C 'size':165C 'sourc':76C 'stack':71C,78C 'start':156C 'stream':128C 'system':83C 'tie':170C 'upper':123C 'version':86C,183C 'websocket':96C,100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-04T10:37:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100403","severity":null,"published_at":"2026-11-13T19:17:36+00:00","modified_at":"2026-11-13T19:17:36+00:00","first_seen_at":"2026-11-13T19:52:09+00:00","fetched_at":"2026-11-13T19:52:09+00:00","note":null}],"documents":[{"id":149125,"url":"https://github.com/bacnet-stack/bacnet-stack/security/advisories/GHSA-4vgv-v5ph-rmxr","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-04T10:37:40+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}