EUVD-2026-34034
GHSA-23jv-8gf4-7r88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessConnect to SSH port of libwebsockets service
-
DeliverySend crafted SSH packet with oversized msg_len field
-
ExploitTrigger unbounded heap allocation in lws_ssh_parse_plaintext
-
ExecutionExhaust server memory
-
ImpactCause denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the target application to be compiled with the optional |
| Impact | The CVSS 3.1 base score of 5.3 (Medium) reflects a network-reachable (AV:N), low-complexity (AC:L), unauthenticated (PR:N), no-interaction (UI:N) attack with limited availability impact (A:L) and no confidentiality or integrity impact. The temporal modifiers raise the operational risk profile: E:P confirms a public proof-of-concept exists, RL:O confirms an official remediation is released, and RC:C marks the vulnerability as confirmed. No EPSS score was provided in the intelligence feed, so exploitation probability cannot be precisely quantified; however, the availability of a functional Python PoC script on GitHub significantly lowers attacker skill requirements. The absence of a CISA KEV listing suggests no confirmed mass exploitation, which is consistent with the narrow attack surface - only deployments using the optional SSH plugin are affected, excluding the majority of libwebsockets users who rely on WebSocket or HTTP functionality. The A:L severity rating implies partial rather than complete service disruption, though repeated rapid requests could compound into full resource exhaustion depending on host memory constraints. |
| Exploit ScenarioDerived | An unauthenticated remote attacker connects to the SSH port of a service built on libwebsockets with the SSH plugin enabled and transmits a crafted SSH packet in which |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 02, 2026
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust server heap resources by sending SSH packets with a crafted oversized msg_len value, resulting in denial of service. The vulnerability is confined to deployments using the optional SSH server plugin (protocol_lws_ssh_base) and carries a CVSS 5.3 Medium rating with no confidentiality or integrity impact. A public proof-of-concept exploit exists and the CVSS temporal vector confirms exploit availability (E:P) and an official patch (RL:O); no CISA KEV listing indicates no confirmed widespread in-the-wild exploitation as of the analysis date.
RemediationAI
Apply upstream patch commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 from the libwebsockets repository (https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498), which enforces a 256 KB maximum SSH packet size in lws_ssh_parse_plaintext. A specific tagged release version incorporating this fix has not been independently confirmed from available data - verify the commit is present in your installed version by inspecting the git log or the sshd.c source for the LWS_SSH_MAX_PACKET_SIZE constant before assuming coverage. As a compensating control where immediate patching is not feasible, disabling or omitting the protocol_lws_ssh_base SSH plugin from the build entirely eliminates the attack surface, at the trade-off of losing SSH functionality. Restricting network access to the SSH port via firewall rules to trusted source IP ranges reduces exposure for authorized clients but does not eliminate the vulnerability. The VulDB advisory is available at https://vuldb.com/cve/CVE-2026-10650.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libwebsockets is a lightweight C library maintained by warmcat that implements WebSocket, HTTP/2, and optionally SSH server functionality via plugin modules. The vulnerable code resides in plugins/protocol_lws_ssh_base/sshd.c, specifically within the lws_ssh_parse_plaintext function responsible for parsing incoming SSH plaintext packets. CWE-400 (Uncontrolled Resource Consumption) is the root cause: prior to the patch, the function accepted the attacker-supplied msg_len field from SSH packet headers without enforcing any upper bound, allowing arbitrarily large heap allocation attempts. The upstream fix (commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498) introduces a compile-time constant LWS_SSH_MAX_PACKET_SIZE of 256 KB (262,144 bytes) and validates msg_len before allocation proceeds, bailing out on oversized packets. CPE cpe:2.3:a:warmcat:libwebsockets:*:*:*:*:*:*:*:* covers all versions through 4.5.8.
Know when Libwebsockets gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
1DescriptionCVE.org
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Libwebsockets
View allAn out-of-bounds heap write in libwebsockets' HTTP/2 HPACK header decoder lets unauthenticated remote attackers corrupt
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by
Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c
An attacker-supplied PNG image can drive an out-of-bounds heap write in libwebsockets' UPNG decoder when a crafted overs
A heap out-of-bounds read in libwebsockets' lws_upng_emit_next_line() function can crash an application when the library
Exploit-DB