CVE-2026-19773
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk50th percentile - higher than 50% of all known CVEs
Summary
libwebsockets contains an out-of-bounds write vulnerability in HTTP/2 HPACK path header parsing. The lack of proper validation of user-supplied data results in a write past the end of an allocated buffer.
Risk Assessment
A remote, unauthenticated attacker can execute arbitrary code in the context of the current process. This can lead to full compromise of the affected service.
Recommendation
Update libwebsockets to a version containing the fix (ZDI-CAN-31036). If immediate patching is not possible, consider restricting network access to services using this library.
Other vulnerabilities in libwebsockets
See all- CVE-2026-95115High
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
- CVE-2026-95114High
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to trigger an out-of-bounds memory read.
- CVE-2026-78161High
A vulnerability was found in libwebsockets 4.5.0 in the report_raw_cbor function of lib/misc/lecp.c in the LECP CBOR Recording component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is public.
- CVE-2026-10650Medium
A flaw has been found in warmcat libwebsockets up to version 4.5.8. The issue affects the function lws_ssh_parse_plaintext in the file plugins/protocol_lws_ssh_base/sshd.c. Manipulation of the msg_len argument can lead to resource consumption. The attack can be launched remotely and the exploit is publicly available.
- CVE-2025-11680Medium
In warmcat libwebsockets, there is an out-of-bounds write vulnerability in unfilter_scanline when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used. This can lead to writing past a heap allocated buffer, possibly causing a crash when the user visits an attacker-controlled website with a crafted PNG file.
- CVE-2025-11679Medium
Out-of-bounds Read in lws_upng_emit_next_line in warmcat libwebsockets allows, when the LWS_WITH_UPNG flag is enabled during compilation and the HTML display stack is used, to read past a heap allocated buffer possibly causing a crash, when the user visits an attacker controlled website that contains a crafted PNG file with a big height dimension.
- CVE-2025-11678High
Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.
- CVE-2025-11677Medium
Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.
Original NVD description (English source)
libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS