EUVD-2026-79130
GHSA-r4m8-276f-3r2f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated (AV:N/PR:N/UI:N), but AC:H because HTTP/2 must be enabled and reliable code execution from a bounded header overflow needs heap grooming; full impact retained given ZDI RCE classification.
Primary rating from Vendor (zdi).
CVSS VectorVendor: zdi
Lifecycle Timeline
3DescriptionCVE.org
libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.
AnalysisAI
An out-of-bounds heap write in libwebsockets' HTTP/2 HPACK header decoder lets unauthenticated remote attackers corrupt memory on any instance compiled with HTTP/2 support (LWS_WITH_HTTP2) and exposing an HTTP/2 listener. The flaw is a missing bound check in lws_frag_append(), which appends header/path fragments without verifying the write stays within the configured max_http_header_data limit, so a crafted HPACK-encoded request header can overrun the destination buffer and potentially yield code execution in the server process context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to be a libwebsockets build with HTTP/2 support enabled and serving over HTTP/2 (LWS_WITH_HTTP2); the flaw is reached only through the HPACK header-decoding path (lws_frag_append when appending a path/header fragment beyond max_http_header_data). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals point to a genuine high-priority memory-corruption flaw, but not one with confirmed active exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix commit 824151862f37bc72f46d9a3e01d5b9408d313a0b (https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b), which introduces a bounds check in lws_frag_append() against max_http_header_data; because the reference is a raw commit rather than a tagged release, upstream fix is available via commit and a published patched release version has not been independently confirmed, so verify the release notes of the libwebsockets version you consume before assuming it contains the guard. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Patch available per vendor advisory: within 24 hours, identify all systems running libwebsockets with HTTP/2 enabled (LWS_WITH_HTTP2) and exposed HTTP/2 listeners; apply the vendor fix commit 824151862f37bc72f46d9a3e01d5b9408d313a0b or a release containing it if available, and if patching is not immediately possible, disable HTTP/2 listeners or recompile without LWS_WITH_HTTP2 as a temporary mitigation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Libwebsockets
View allOut-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust serv
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today