chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumption

published 2026-11-06 2 d ago modified 2026-11-06 2 d ago also EUVD-2026-118382

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 29%
public exploits: 0; none known

A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.

Patch / fix

fixed in 1 links 3

chenyme grok2api 3.1.7

github.com/chenyme/grok2api@7ad0f79 commit
github.com/chenyme/grok2api#1073 pull request
github.com/chenyme/grok2api/releases/tag/v3.1.7 release

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected products

chenyme grok2api

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-404 Improper Resource Shutdown or Release

References

github.com /chenyme/grok2api/pull/1073
issue-tracking, patch
github.com /chenyme/grok2api/commit/7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4
patch
github.com /chenyme/grok2api/releases/tag/v3.1.7
patch
vuldb.com /vuln/431905
vdb-entry, technical-description
vuldb.com /vuln/431905/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-123748
third-party-advisory
vuldb.com /submit/1033605
third-party-advisory
github.com /chenyme/grok2api/issues/1071
issue-tracking
github.com /chenyme/grok2api/
product

Sources

CVE List CVE-2026-123748
NVD CVE-2026-123748

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary