Read the docs
TI-2026-86043 Aliases CVE-2026-123748GHSA-rv3x-8h48-5m2m

Uncontrolled resource consumption in chenyme grok2api WebSocket proxy

Priority LOW 24CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

chenyme grok2api up to and including 3.1.6 contains an uncontrolled resource consumption flaw (CWE-400) in the proxyVoiceWebSocket function of its WebSocket proxy. A remote attacker with low privileges can consume server resources and degrade availability, and no user interaction is needed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

A security flaw has been discovered in chenyme grok2api up to 3.1.6. Affected by this vulnerability is the function proxyVoiceWebSocket of the file backend/internal/transport/http/inference/voice_ws_handler.go of the component WebSocket Proxy. The manipulation results in resource consumption. The attack may be launched remotely. Upgrading to version 3.1.7 addresses this issue. The patch is identified as 7ad0f791f0a9eb5a0ddfe38ac4dfcef01e19a6d4. It is suggested to upgrade the affected component.

Why it matters now

EPSS 0.00354 29th percentileScored 2026-11-07
Fix Fixed grok2api (chenyme): 3.1.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
chenymegrok2api3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.63.1.7Patch availableCNA
  • grok2api Vendorchenyme Affected 3.1.0; 3.1.1; 3.1.2; 3.1.3; 3.1.4; 3.1.5; 3.1.6 Fixed in 3.1.7 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:*——chenyme
  • cpe:2.3:a:chenyme:grok2api:*:*:*:*:*:*:*:* Versions — — ·chenyme

Remediation

Upgrade chenyme grok2api to version 3.1.7, which fixes the issue. The fix is identified by commit 7ad0f79.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA grok2api (chenyme) Fixed in 3.1.7

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123748
  2. 2026-11-06 Alias added: GHSA-rv3x-8h48-5m2m

References

Patch 3

Other 2

  • TI-2026-86141 Improper workflow enforcement in chenyme grok2api STT billing CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences