CVE-2026-19773
CriticalCVSS 9.8Summary
libwebsockets contains an out-of-bounds write vulnerability in HTTP/2 HPACK path header parsing. The lack of proper validation of user-supplied data results in a write past the end of an allocated buffer.
Risk Assessment
A remote, unauthenticated attacker can execute arbitrary code in the context of the current process. This can lead to full compromise of the affected service.
Recommendation
Update libwebsockets to a version containing the fix (ZDI-CAN-31036). If immediate patching is not possible, consider restricting network access to services using this library.
Other vulnerabilities in libwebsockets
See all- CVE-2026-78161High
A vulnerability was found in libwebsockets 4.5.0 in the report_raw_cbor function of lib/misc/lecp.c in the LECP CBOR Recording component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is public.
- CVE-2026-10650Medium
A flaw has been found in warmcat libwebsockets up to version 4.5.8. The issue affects the function lws_ssh_parse_plaintext in the file plugins/protocol_lws_ssh_base/sshd.c. Manipulation of the msg_len argument can lead to resource consumption. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.