Textream's WebSocket server imposed no limit on concurrent connections. Flooding it exhausted CPU and memory and could freeze the app during a live session.
Summary
In Textream for macOS prior to 1.5.1, the DirectorServer WebSocket server imposed no limit on concurrent connections.
Impact
Combined with a broadcast timer sending state to all clients every 100 ms, an attacker could exhaust CPU and memory by flooding the server, freezing and crashing the application during a live session.
Fix
Update to 1.5.1 or later. If you run your own server, cap concurrent connections and limit connections per source.
References:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28412
- GitHub Security Advisory: https://github.com/f/textream/security/advisories/GHSA-qr5p-7x47-qxh9
- Fix commit: https://github.com/f/textream/commit/3524fa96f98ba17025b48ce9e19d49d859fc2ec1
- CVE record (MITRE): https://www.cve.org/CVERecord?id=CVE-2026-28412
- CVE record (Feedly): https://feedly.com/cve/CVE-2026-28412
Originally published at iamcanturk.dev.
Top comments (0)