Summary `ws_read_frame()` decodes a frame's 64-bit extended payload length with a 32-bit byte swap, discarding the upper half, and stores the result in a signed 32-bit length. A declared length whose surviving half has its high bit set becomes negative, satisfies the signed buffer-size check, and is then reinterpreted as an enormous unsigned count by the loop that fills the receive buffer. Any client able to complete a WebSocket upgrade reaches this before authentication. Impact An unbounded write of client-supplied bytes past the 64 KiB receive buffer inside the connection's heap-allocated handle. It runs forward through the adjacent send buffer and into the handle's own state, including its buffer length, payload pointer and `SSL *`. Realized effects range from a crash to corruption of that pointer state; remote code execution has not been demonstrated. Decoding runs on the thread servicing the connection, so a crash takes down the process and every concurrent session. Affected configurations Installations that load `mod_xml_rpc` and enable its WebSocket endpoint. Both are opt-in: the module is commented out of the stock `modules.conf.xml` and `enable-websocket` out of the shipped `xml_rpc.conf.xml`, so a default installation never reaches the code. Where enabled, the endpoint is served on the module's `http-port`, 8080 by default. All current 1.10 and 1.11 releases are affected. Attack prerequisites A TCP connection to the module's HTTP port and a completed WebSocket upgrade. No credentials are needed even where `auth-realm`, `auth-user` and `auth-pass` are set: `/socket` requests are dispatched to the WebSocket handler ahead of the HTTP digest checks, so an operator who believes the service is authenticated is still exposed. One frame using the 8-byte extended length field suffices. Workarounds Leave `enable-websocket` unset, which closes `/socket` while the rest of the XML-RPC service keeps working, or do not load `mod_xml_rpc`. Where the endpoint is required, restrict the HTTP port to trusted networks at the firewall; HTTP authentication does not gate this path. Fix The extended length is now decoded across all 64 bits in network byte order, and a length that does not fit the receive buffer is rejected with a protocol close while still unsigned, so it can no longer reach the signed field as a negative number. Frames that previously parsed are unaffected. Credit Tristan Madani (Talence Security)