CVE-2026-123748 Details
Description
A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.
A denial-of-service vulnerability has been identified in Chenyme Grok2API versions through 3.1.6. The issue resides in the WebSocket proxy for voice processing, specifically within the 'proxyVoiceWebSocket' function of 'backend/internal/transport/http/inference/voice_ws_handler.go'. This vulnerability allows for excessive resource consumption by not properly managing WebSocket connection timeouts, which can be exploited remotely. As a result, an active WebSocket session can be prolonged indefinitely, bypassing the server's request timeout settings and potentially degrading service for other users.
Upgrade to Chenyme Grok2API version 3.1.7, which includes a patch for this vulnerability by implementing proper timeout handling for WebSocket sessions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/chenyme/grok2api/ | [email protected] | ProductVendor |
| https://github.com/chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4 | [email protected] | Source CodeVendor |
| https://github.com/chenyme/grok2api/issues/1071 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/chenyme/grok2api/pull/1073 | [email protected] | Issue TrackingVendor |
| https://github.com/chenyme/grok2api/releases/tag/v3.1.7 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-123748 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1033605 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431905 | [email protected] | Permission Required |
| https://vuldb.com/vuln/431905/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| chenyme grok2api | <= 3.1.6 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |