OneUptime Memory Exhaustion (CVE-2026-69185): Exposure and Response

Why the public endpoint changes the risk

CVE-2026-69185 is a product-level denial-of-service issue in OneUptime. The advisory identifies versions before 12.0.14 as affected. OneUptime's public realtime WebSocket path passes frames to socket.io-parser before application-level user authorization, turning an upstream parser bug into an unauthenticated exposure.

A zero-attachment binary event can leave a reconstructor installed. Later binary frames remain buffered because the completion condition cannot return to zero. Repeated frames therefore increase retained memory until the shared App/API/realtime process restarts or stops.

Exposure conditions

• OneUptime is older than 12.0.14.
• The public /realtime path is reachable.
• The deployed lockfile still resolves socket.io-parser before 4.2.7.
• The realtime function shares memory and restart boundaries with other application services.

Response sequence

1. Inventory the external realtime route and its proxy behavior.
2. Confirm the OneUptime image, digest, lockfile, and installed parser version.
3. Upgrade to OneUptime 12.0.14 or later and rebuild the App image.
4. Regression-test zero-attachment binary packets and normal realtime behavior.
5. Add pre-connection authentication plus connection and frame limits as defense in depth.
6. Monitor heap, RSS, restart count, and WebSocket error rates after deployment.

Deployment validation

A changed version label is not enough. Confirm that the rebuilt image contains socket.io-parser 4.2.7 or later, that memory returns to a stable baseline after abnormal connections, and that normal status updates and notifications continue to work. Keep the vulnerable image out of rollback paths.

Verification time

The OneUptime product advisory was rechecked for the August 25, 2026 14:00 KST cycle. The fixed boundary and operational guidance follow the first-party advisory.