Libwebsockets
Monthly
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust server heap resources by sending SSH packets with a crafted oversized `msg_len` value, resulting in denial of service. The vulnerability is confined to deployments using the optional SSH server plugin (`protocol_lws_ssh_base`) and carries a CVSS 5.3 Medium rating with no confidentiality or integrity impact. A public proof-of-concept exploit exists and the CVSS temporal vector confirms exploit availability (E:P) and an official patch (RL:O); no CISA KEV listing indicates no confirmed widespread in-the-wild exploitation as of the analysis date.
Out-of-bounds write in warmcat libwebsockets 4.5.0 allows remote unauthenticated attackers to corrupt process memory by submitting crafted CBOR-encoded data to any network-accessible endpoint using the LECP CBOR parser. The root cause is a dual defect in `lecp_parse` and `report_raw_cbor` within `lib/misc/lecp.c`: an equality-only bounds check (`== sizeof(ctx->cbor)`) fails to catch cases where `cbor_pos` has already exceeded the buffer limit, and `cbor_pos` was reset after rather than before the flush callback, creating a window for sequential over-increment. No public exploit identified as confirmed active exploitation (CISA KEV), but a public proof-of-concept is confirmed at the referenced GitHub repository, and a patch commit has been issued upstream.
Unbounded memory allocation in warmcat libwebsockets up to 4.5.8 allows remote unauthenticated attackers to exhaust server heap resources by sending SSH packets with a crafted oversized `msg_len` value, resulting in denial of service. The vulnerability is confined to deployments using the optional SSH server plugin (`protocol_lws_ssh_base`) and carries a CVSS 5.3 Medium rating with no confidentiality or integrity impact. A public proof-of-concept exploit exists and the CVSS temporal vector confirms exploit availability (E:P) and an official patch (RL:O); no CISA KEV listing indicates no confirmed widespread in-the-wild exploitation as of the analysis date.