Libwebsockets
Monthly
Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.
An out-of-bounds heap write in libwebsockets' HTTP/2 HPACK header decoder lets unauthenticated remote attackers corrupt memory on any instance compiled with HTTP/2 support (LWS_WITH_HTTP2) and exposing an HTTP/2 listener. The flaw is a missing bound check in lws_frag_append(), which appends header/path fragments without verifying the write stays within the configured max_http_header_data limit, so a crafted HPACK-encoded request header can overrun the destination buffer and potentially yield code execution in the server process context. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published an upstream fix commit (824151862f37bc72f46d9a3e01d5b9408d313a0b), and while the raw severity is rated 9.8 (CVSS 3.0), the independent assessment scores it CVSS 3.1 AV:N/AC:H, reflecting that the bounded write must still be shaped by heap layout and platform to become reliable arbitrary code execution rather than a crash. Affected: libwebsockets builds with HTTP/2 enabled; HTTP/1.1-only or non-HTTP/2 builds are not reachable through this path.
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust server heap resources by sending SSH packets with a crafted oversized `msg_len` value, resulting in denial of service. The vulnerability is confined to deployments using the optional SSH server plugin (`protocol_lws_ssh_base`) and carries a CVSS 5.3 Medium rating with no confidentiality or integrity impact. A public proof-of-concept exploit exists and the CVSS temporal vector confirms exploit availability (E:P) and an official patch (RL:O); no CISA KEV listing indicates no confirmed widespread in-the-wild exploitation as of the analysis date.
An attacker-supplied PNG image can drive an out-of-bounds heap write in libwebsockets' UPNG decoder when a crafted oversized width value overflows the arithmetic used to size a heap allocation. Only deployments compiled with the non-default LWS_WITH_UPNG flag that also exercise the library's HTML display stack are exposed, and exploitation additionally requires a user to visit an attacker-controlled page serving the malicious PNG, so the realistically reachable population is small. Impact is limited to a crash or denial of service (availability only, no confidentiality or integrity loss); no public exploit code has been identified at time of analysis and EPSS is low at 0.39% (31st percentile).
A heap out-of-bounds read in libwebsockets' lws_upng_emit_next_line() function can crash an application when the library is compiled with the non-default LWS_WITH_UPNG flag and the HTML display stack is in use. A remote, unauthenticated attacker can trigger the flaw by hosting a crafted PNG with an abnormally large height dimension on a site the victim visits, causing the affected process to read past a heap-allocated buffer and potentially terminate. Exploitation is constrained by the compile-time feature gate and the requirement that the HTML display path be reachable, so vulnerable builds are uncommon; EPSS is low (0.39%, 31st percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Denial of service is possible in libwebsockets because the LEJP JSON parser's pre-patch bounds checks in lib/misc/lejp.c permit a one-past-the-end write into the fixed-size ctx->i[] and ctx->st[] arrays when deeply nested JSON is parsed. The flaw is remotely reachable and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5), but the affected target is the main-branch commit 106d542c rather than a confirmed released version, and exploitability depends entirely on whether the host application routes attacker-controlled JSON into lejp_parse(); impact is limited to availability (a crash), with no code execution or data disclosure indicated. EPSS is 0.29% (20th percentile), the issue is not in CISA KEV, and no public exploit has been identified at time of analysis, although upstream fixes exist in commits 736a4a2 and c404a20.
An out-of-bounds heap write in libwebsockets' HTTP/2 HPACK header decoder lets unauthenticated remote attackers corrupt memory on any instance compiled with HTTP/2 support (LWS_WITH_HTTP2) and exposing an HTTP/2 listener. The flaw is a missing bound check in lws_frag_append(), which appends header/path fragments without verifying the write stays within the configured max_http_header_data limit, so a crafted HPACK-encoded request header can overrun the destination buffer and potentially yield code execution in the server process context. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has published an upstream fix commit (824151862f37bc72f46d9a3e01d5b9408d313a0b), and while the raw severity is rated 9.8 (CVSS 3.0), the independent assessment scores it CVSS 3.1 AV:N/AC:H, reflecting that the bounded write must still be shaped by heap layout and platform to become reliable arbitrary code execution rather than a crash. Affected: libwebsockets builds with HTTP/2 enabled; HTTP/1.1-only or non-HTTP/2 builds are not reachable through this path.
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust server heap resources by sending SSH packets with a crafted oversized `msg_len` value, resulting in denial of service. The vulnerability is confined to deployments using the optional SSH server plugin (`protocol_lws_ssh_base`) and carries a CVSS 5.3 Medium rating with no confidentiality or integrity impact. A public proof-of-concept exploit exists and the CVSS temporal vector confirms exploit availability (E:P) and an official patch (RL:O); no CISA KEV listing indicates no confirmed widespread in-the-wild exploitation as of the analysis date.
An attacker-supplied PNG image can drive an out-of-bounds heap write in libwebsockets' UPNG decoder when a crafted oversized width value overflows the arithmetic used to size a heap allocation. Only deployments compiled with the non-default LWS_WITH_UPNG flag that also exercise the library's HTML display stack are exposed, and exploitation additionally requires a user to visit an attacker-controlled page serving the malicious PNG, so the realistically reachable population is small. Impact is limited to a crash or denial of service (availability only, no confidentiality or integrity loss); no public exploit code has been identified at time of analysis and EPSS is low at 0.39% (31st percentile).
A heap out-of-bounds read in libwebsockets' lws_upng_emit_next_line() function can crash an application when the library is compiled with the non-default LWS_WITH_UPNG flag and the HTML display stack is in use. A remote, unauthenticated attacker can trigger the flaw by hosting a crafted PNG with an abnormally large height dimension on a site the victim visits, causing the affected process to read past a heap-allocated buffer and potentially terminate. Exploitation is constrained by the compile-time feature gate and the requirement that the HTML display path be reachable, so vulnerable builds are uncommon; EPSS is low (0.39%, 31st percentile) and no public exploit code or confirmed active exploitation has been identified at time of analysis.