AIKIDO-2026-820211

TL;DR

The Cython WebSocket frame parser in picows.pyx reads a client-supplied 64-bit extended payload length into a signed Py_ssize_t field without checking the RFC 6455-forbidden high bit. A remote client that completes a normal WebSocket handshake can send a single frame whose length sets that high bit, producing a negative value that bypasses the max_frame_size and payload-completeness checks. The negative length is then reinterpreted as a huge unsigned size_t in the payload-masking routine, which reads and writes far outside the receive buffer and crashes the server process. The fix rejects forbidden high-bit and non-minimal extended-length encodings with a protocol error before they are used.