# CVE-2026-28412: Resource exhaustion through unlimited connections (DoS)

> Textream's WebSocket server imposed no limit on concurrent connections. Flooding it exhausted CPU and memory and could freeze the app during a live session.

URL: https://iamcanturk.dev/en/security/cve-2026-28412/
CVSS 6.5 (MEDIUM) · Textream (macOS) < 1.5.1 · March 2026

---

## Summary

In Textream for macOS prior to 1.5.1, the `DirectorServer` WebSocket server imposed no limit on concurrent connections.

## Impact

Combined with a broadcast timer sending state to all clients every 100 ms, an attacker could exhaust CPU and memory by flooding the server, freezing and crashing the application during a live session.

## Fix

Update to **1.5.1 or later**. If you run your own server, cap concurrent connections and limit connections per source.

References:
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-28412
- GitHub Security Advisory: https://github.com/f/textream/security/advisories/GHSA-qr5p-7x47-qxh9
- Fix commit: https://github.com/f/textream/commit/3524fa96f98ba17025b48ce9e19d49d859fc2ec1
- CVE record (MITRE): https://www.cve.org/CVERecord?id=CVE-2026-28412
- CVE record (Feedly): https://feedly.com/cve/CVE-2026-28412