AIKIDO-2026-829005

TL;DR

The WebSocket frame defragmenter reassembles fragmented messages but only caps the accumulated byte size, never the number of fragments, and re-folds every previously buffered fragment each time a new one arrives. A peer that streams many zero length continuation frames (roughly 600 KB of wire data, about 100,000 empty frames) drives quadratic work over the growing fragment buffer, pinning a service thread and exhausting CPU. The fix caps the fragment count with a TooManyFragments limit and stops re-processing already buffered fragments.