Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c. https://nvd.nist.gov/vuln/detail/CVE-2017-15268