Three robustness/security fixes in the frame path - #120

Open

marcocarnut wants to merge 3 commits into

Theldus:masterfrom

marcocarnut:security-hardening

Commits on Sep 16, 2026

Fix off-by-one out-of-bounds write on a 125-byte control frame

marcocarnut
and
claude
committed
384d96b
Reject unmasked client frames (RFC 6455 section 5.1)

marcocarnut
and
claude
committed
bc928f3

Commits on Sep 17, 2026

Bound the handshake read with SO_RCVTIMEO (slowloris mitigation)

marcocarnut
and
claude
committed
55a0cfa