CVE-2025-11678

libwebsockets contains an out-of-bounds write vulnerability in HTTP/2 HPACK path header parsing. The lack of proper validation of user-supplied data results in a write past the end of an allocated buffer.

A vulnerability was found in libwebsockets 4.5.0 in the report_raw_cbor function of lib/misc/lecp.c in the LECP CBOR Recording component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is public.

A flaw has been found in warmcat libwebsockets up to version 4.5.8. The issue affects the function lws_ssh_parse_plaintext in the file plugins/protocol_lws_ssh_base/sshd.c. Manipulation of the msg_len argument can lead to resource consumption. The attack can be launched remotely and the exploit is publicly available.

In warmcat libwebsockets, there is an out-of-bounds write vulnerability in unfilter_scanline when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used. This can lead to writing past a heap allocated buffer, possibly causing a crash when the user visits an attacker-controlled website with a crafted PNG file.

Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.

Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.