CVE-2026-28412 PUBLISHED

Textream Vulnerable to Uncontrolled Resource Consumption (Denial of Service)

Assigner: GitHub_M
Reserved: 27.02.2026 Published: 02.03.2026 Updated: 02.03.2026

Textream is a free macOS teleprompter app. Prior to version 1.5.1, the DirectorServer WebSocket server imposes no limit on concurrent connections. Combined with a broadcast timer that sends state to all connected clients every 100 ms, an attacker can exhaust CPU and memory by flooding the server with connections, causing the Textream application to freeze and crash during a live session. Version 1.5.1 fixes the issue.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS Score: 6.5

Product Status

Vendor f
Product textream
Versions
  • Version < 1.5.1 is affected

References

Problem Types

  • CWE-400: Uncontrolled Resource Consumption CWE