libwebsockets CVE-2025-11677

Exploitation requires a specific, non-default deployment: the application embedding libwebsockets must provide a user callback that handles the LWS_CALLBACK_HTTP_CONFIRM_UPGRADE event, which is the exact condition named in the description; servers that do not implement this callback path are not affected. Further limiting factors are high attack complexity and a present attack requirement (AT:P in the CVSS 4.0 vector), indicating a timing-sensitive use-after-free window that is not reliably controllable by the attacker. No authentication is required (PR:N) and the vector is network-reachable, but the impact is confined to availability (denial of service) with no confidentiality or integrity effect.

This is a genuinely low-priority issue despite a moderate 6.3 CVSS 4.0 score, and the signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) shows network reachability with no authentication, but high attack complexity combined with a present attack requirement (AT:P) - meaning exploitation depends on conditions outside the attacker's control (the target's deployment must register a user callback handling LWS_CALLBACK_HTTP_CONFIRM_UPGRADE) and likely on winning a use-after-free timing window. Impact is availability-only (VC:N/VI:N/VA:L); there is no confidentiality or integrity exposure, so the worst realistic outcome is a crash/denial of service of the affected service, not code execution or data theft. EPSS reinforces low urgency at 0.40% (33rd percentile), there is no CISA KEV listing, and no public exploit code was identified in the provided sources. The one escalating factor is that the flaw was reported by a credible research team (Nozomi Networks), and libwebsockets is embedded in many IoT/embedded and appliance stacks - but the non-default configuration prerequisite sharply narrows the exploitable population. Net: patch in normal cycles; this is not an emergency.

A remote, unauthenticated attacker targets a service built on libwebsockets that has registered a user callback handling LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, sending crafted WebSocket upgrade handshake traffic to lws_handshake_server to trigger a use-after-free. Because attack complexity is high and a timing/configuration precondition (AT:P) applies, reliable exploitation is difficult, and the only demonstrated impact is a denial of service (crash) of the WebSocket server. No public exploit code was identified at time of analysis.