EUVD-2026-98806
GHSA-9f4q-6c78-chwx
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted nested JSON to LEJP parser
-
ExploitOverflow ctx->i/ctx->sp fixed stack arrays (OOB write)
-
ImpactCrash host process (denial of service)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable path is the LEJP JSON parser in lib/misc/lejp.c (lejp_parse): deeply nested JSON drives ctx->ipos or ctx->sp to the size of the fixed ctx->i[]/ctx->st[] arrays, and the pre-patch checks (ctx->ipos > SIZE instead of >= SIZE, and ++ctx->sp == SIZE) allow a one-past-the-end write. Required: the host application must route attacker-controlled JSON into lejp_parse. LIMITING FACTORS: libwebsockets is a library, so exploitability depends entirely on the embedding application exposing LEJP to untrusted input; the affected target is main-branch commit 106d542c rather than a confirmed released version; impact is a crash (availability) only - no code execution or data disclosure is indicated. |
| Impact | Signals are consistent and point to a genuine but bounded availability-only issue. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 High) correctly scores DoS-only impact: confidentiality and integrity are N, only availability is H, which matches the description (denial of service) and the CWE-787 out-of-bounds write seen in the patched off-by-one index checks on ctx->i/ctx->ipos and ctx->sp in lib/misc/lejp.c. Exploitation signals are LOW: EPSS is 0.29% (20th percentile), there is NO CISA KEV listing, and no SSVC decision data was provided. A gist reference is present (likely a reproducer/PoC), so public exploit material appears to exist, but PoC availability is a distinct signal from active exploitation and nothing here indicates in-the-wild use. IMPORTANT CAVEAT the raw CVSS does not capture: libwebsockets is a LIBRARY, and the affected target is 'main 106d542c' - a development/main-branch commit, not a tagged release (CPE and EUVD both show n/a). The AV:N/PR:N rating assumes the embedding application feeds untrusted network JSON into the LEJP parser; where it does not, real-world reachability is much lower than 7.5 implies. Net: a legitimate patch-worthy DoS bug, but not an emergency-tier priority - no RCE, no active exploitation, low EPSS. |
| Exploit ScenarioDerived | An attacker sends a crafted JSON document (e.g. with excessive array/object nesting) to a service that passes attacker-controlled input to libwebsockets' LEJP parser. The parser increments ctx->ipos or ctx->sp past the fixed bounds of ctx->i[]/ctx->st[] before the bounds check, writing out of bounds and crashing the process. A reproducer gist is publicly referenced, so exploit material appears to exist. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.
RemediationAI
The primary fix is to update libwebsockets to a build that includes the corrected LEJP bounds checks in commits 736a4a26fce344766bc6618df87bf32193829dd0 and c404a205a98323a7f60e69fae532c5d26bf4a62a (upstream fix available as PR/commit; released patched version not independently confirmed), then rebuild and redeploy the embedding application. Where rebuilding is not immediately possible, reduce exposure by ensuring untrusted JSON is never passed to lejp_parse() without a depth and length limit: pre-validate or reject payloads whose nesting depth or path length exceeds the parser's fixed arrays, or route untrusted/peer-supplied JSON through a separate depth-limited parser instead, accepting the added latency and the need to keep two parsing paths consistent. Disabling LEJP-dependent features (for example JSON-over-WebSocket message handling) removes the attack surface outright but also disables that functionality, and restricting network access to endpoints that accept JSON limits who can reach the vulnerable parser at the cost of some legitimate traffic. Because the effect is a crash rather than code execution, process supervision and watchdog restart with rate limiting can reduce downtime, but they do not remove the underlying out-of-bounds write. Track the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-95115 and GitHub issue https://github.com/warmcat/libwebsockets/issues/3663 for any released version or advisory updates.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
libwebsockets is a C library used for WebSocket and HTTP server/client functionality, and LEJP (Lightweight Embedded JSON Parser) is its streaming, callback-driven JSON parser. Inside lejp_parse(), parser state is held in a caller-supplied struct lejp_ctx that contains fixed-size arrays: ctx->st[] (state stack) and ctx->i[] (JSON path index stack). The pre-patch code writes ctx->i[ctx->ipos++] = 0 and then checks ctx->ipos > LWS_ARRAY_SIZE(ctx->i), and increments the state stack with if (++ctx->sp == LWS_ARRAY_SIZE(ctx->st)) - both orderings and comparisons are wrong, so a deeply nested or long JSON path can advance the index to the array size and perform the write before the boundary is detected. The upstream commits reorder the check ahead of the store and change the comparisons to >= after casting to int (if (ctx->ipos >= (int)LWS_ARRAY_SIZE(ctx->i)) and if (ctx->sp + 1 >= (int)LWS_ARRAY_SIZE(ctx->st))), eliminating the off-by-one. The root cause class is CWE-787 (out-of-bounds write); because the affected arrays live in the parser context rather than the network stack, the practical consequence is memory corruption that crashes the embedding process. No CPE has been assigned (the input CPE is cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) and ENISA EUVD lists affected versions only as n/a n/a, so no released version range is confirmed; the vulnerable variant is main-branch commit 106d542c.
Know when Libwebsockets gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable JSON parser with no auth or interaction in the default reachable case (AV:N/AC:L/PR:N/UI:N); bounded OOB write yields crash only, so C:N/I:N/A:H.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
3DescriptionCVE.org
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
Executive ViewAI
libwebsockets deployments that route untrusted JSON into the LEJP parser are exposed to a remotely triggerable denial-of-service condition that can crash affected services and disrupt availability for users of those applications. The issue has no confirmed released product target, no CISA KEV listing, and no public exploit identified at time of analysis, but no vendor-released patch is available and upstream fixes exist only as commits. Leadership should prioritize identifying internet-facing or multi-tenant services that accept attacker-controlled JSON, because the primary business risk is service interruption rather than data compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting or disabling lejp_parse for attacker-controlled JSON, enforcing JSON depth and payload-size limits at reverse proxies, API gateways, or WAFs, rate-limiting affected endpoints, isolating and auto-restarting affected services, monitoring for crashes, and validating upstream fixes 736a4a2 and c404a20 before deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Libwebsockets
View allAn out-of-bounds heap write in libwebsockets' HTTP/2 HPACK header decoder lets unauthenticated remote attackers corrupt
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust serv
An attacker-supplied PNG image can drive an out-of-bounds heap write in libwebsockets' UPNG decoder when a crafted overs
A heap out-of-bounds read in libwebsockets' lws_upng_emit_next_line() function can crash an application when the library
Exploit-DB