WAD Worker Memory Leak in HTTP 101 Switching Protocols (WebSocket) Upgrades
FortiOS proxy worker process /bin/wad steadily leaks SSL state tracking buffers when client applications upgrade HTTP/1.1 connections to persistent WebSockets (HTTP 101), driving enterprise firewalls into memory conserve mode within 48–72 hours.
Technical Root Cause Analysis
When web-based collaboration applications such as Microsoft Teams, Slack, Zoom, and trading platforms establish communication channels through FortiGate proxy-mode inspection, they initiate standard HTTP Upgrade: websocket handshakes. Upon receiving an HTTP/101 Switching Protocols response, the WAD worker allocates an internal frame management struct (wad_ws_frame_buf_t) to parse full-duplex binary and text frames over TLS.
In FortiOS 7.2.4 through 7.2.7, the SSL state machine fails to decrement reference counters on the initial HTTP transition context when transitioning the socket to long-term framing. Because SaaS applications maintain WebSocket connections indefinitely using lightweight ping/pong keepalives, each connection permanently ties up between 64 KB and 256 KB of non-reclaimable worker heap memory. Over several days of enterprise office usage, worker memory balloons until FortiOS reaches memory conserve mode (88% RAM threshold), causing random session terminations and proxy drops.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.4 – 7.2.7 | 7.2.8+ | Bypass deep inspection for SaaS WebSockets |
| FortiOS 7.4 | 7.4.0 – 7.4.2 | 7.4.3+ | Upgrade recommended or switch to flow mode |
| FortiOS 7.0 | Not Affected | 7.0.x Branch Clean | Legacy WebSocket framing pipeline clean |
Platform Impact: Affects FortiGate 60F through 1000F models performing proxy-mode SSL inspection on enterprise networks with heavy Microsoft Teams, Slack, or web-based trading application usage.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these commands to inspect current WAD memory consumption and determine if WebSocket frame buffers are accumulating:
Diagnostic Commands
# 1. Query WAD worker memory allocations and active slab usage
diagnose test application wad 1000
# 2. Check top memory-consuming processes across the system
diagnose sys top-mem 10
# 3. Dump WAD session and buffer statistics
diagnose test application wad 2200Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
Restarting individual WAD workers momentarily resets active proxy-inspected sessions, but hardware-accelerated (NPU) flow sessions and routing functions continue without interruption.
Yes. Flow-mode UTM inspection utilizes the IPS engine rather than the WAD proxy daemon for protocol parsing, bypassing the vulnerable WebSocket state machine entirely.
In environments with 200–500 active users running Teams or Slack, each WAD worker typically leaks 100 MB to 300 MB per 24-hour period.