EUVD-2026-34034
GHSA-23jv-8gf4-7r88
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
AnalysisAI
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust server heap resources by sending SSH packets with a crafted oversized msg_len value, resulting in denial of service. The vulnerability is confined to deployments using the optional SSH server plugin (protocol_lws_ssh_base) and carries a CVSS 5.3 Medium rating with no confidentiality or integrity impact. A public proof-of-concept exploit exists and the CVSS temporal vector confirms exploit availability (E:P) and an official patch (RL:O); no CISA KEV listing indicates no confirmed widespread in-the-wild exploitation as of the analysis date.
Technical ContextAI
libwebsockets is a lightweight C library maintained by warmcat that implements WebSocket, HTTP/2, and optionally SSH server functionality via plugin modules. The vulnerable code resides in plugins/protocol_lws_ssh_base/sshd.c, specifically within the lws_ssh_parse_plaintext function responsible for parsing incoming SSH plaintext packets. CWE-400 (Uncontrolled Resource Consumption) is the root cause: prior to the patch, the function accepted the attacker-supplied msg_len field from SSH packet headers without enforcing any upper bound, allowing arbitrarily large heap allocation attempts. The upstream fix (commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498) introduces a compile-time constant LWS_SSH_MAX_PACKET_SIZE of 256 KB (262,144 bytes) and validates msg_len before allocation proceeds, bailing out on oversized packets. CPE cpe:2.3:a:warmcat:libwebsockets:*:*:*:*:*:*:*:* covers all versions through 4.5.8.
RemediationAI
Apply upstream patch commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 from the libwebsockets repository (https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498), which enforces a 256 KB maximum SSH packet size in lws_ssh_parse_plaintext. A specific tagged release version incorporating this fix has not been independently confirmed from available data - verify the commit is present in your installed version by inspecting the git log or the sshd.c source for the LWS_SSH_MAX_PACKET_SIZE constant before assuming coverage. As a compensating control where immediate patching is not feasible, disabling or omitting the protocol_lws_ssh_base SSH plugin from the build entirely eliminates the attack surface, at the trade-off of losing SSH functionality. Restricting network access to the SSH port via firewall rules to trusted source IP ranges reduces exposure for authorized clients but does not eliminate the vulnerability. The VulDB advisory is available at https://vuldb.com/cve/CVE-2026-10650.
More in Libwebsockets
View allSame weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today