Security readout for executives and security teams
Plain-English summary
CryptPad 2025.3.1 has a denial-of-service weakness where an unauthenticated remote attacker can overwhelm an instance using WebSocket traffic. The expected business impact is service disruption for all users of the affected CryptPad deployment, not data theft or data modification based on the provided CVSS vector.
Executive priority
Treat this as a high-priority availability risk for organizations relying on CryptPad for collaboration. It does not appear to be a confidentiality breach from the supplied data, but disruption could be broad if the instance is public-facing and unpatched.
Technical view
The issue is described as an unbounded WebSocket frame flood mapped to CWE-770. CVSS 4.0 is 8.7 high, with network attack vector, low complexity, no privileges, no user interaction, and high availability impact. The source bundle states it is fixed in CryptPad 2026.2.2, though one affected-version entry is internally inconsistent.
Likely exposure
Internet-accessible CryptPad instances are the primary concern, especially deployments running CryptPad 2025.3.1. The source bundle does not identify managed-service exposure, default configurations, or specific deployment patterns beyond remote unauthenticated reachability.
Exploitation context
No CISA KEV listing is indicated, and the provided sources do not confirm active exploitation. Exploitation would target service availability by exhausting resources through WebSocket handling, potentially affecting all users of a CryptPad instance.
Researcher notes
The provided metadata contains a conflict: the description says fixed in 2026.2.2, while the affected list includes 2026.2.2 with defaultStatus affected. Validate against the CVE record, CSAF, and upstream pull request before final scoping.
Mitigation direction
- Identify all self-hosted CryptPad instances and their running versions.
- Prioritize upgrade planning for CryptPad deployments running 2025.3.1.
- Use vendor guidance and the referenced upstream fix before changing production systems.
- Apply network-layer rate limiting or protective controls if supported by your environment.
- Monitor CryptPad availability and resource usage for abnormal WebSocket-related load.
Validation and detection
- Confirm whether each CryptPad instance is version 2025.3.1 or otherwise vendor-identified as affected.
- Verify whether the instance has been upgraded to the vendor-stated fixed version, 2026.2.2.
- Review vendor release notes or the referenced pull request for the applied fix.
- Check edge proxy, WAF, or load balancer logs for unusual WebSocket volume.
- Validate service health after remediation during normal and peak usage.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-51846 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- urlCVE reference
- urlCVE reference
- urlCVE reference
- urlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.