CVE-2025-11677 Details

A use-after-free vulnerability has been identified in the WebSocket server implementation of Warmcat Libwebsockets version 4.4. This vulnerability may allow an attacker to cause a denial-of-service condition, but only under specific configurations where the user provides a callback function to handle 'LWS_CALLBACK_HTTP_CONFIRM_UPGRADE'. The issue arises in the 'lws_handshake_server' function when the upgrade header is invalid. The function frees certain data in the WebSocket instance structure and then improperly uses a pointer to the freed data in subsequent operations, creating the potential for exploitation.

The vulnerability can be addressed by modifying the 'lws_handshake_server' function to ensure that the code handling the upgrade confirmation is only executed when the upgrade header is valid. This can be done by enclosing the relevant code in an 'else' branch, preventing the use of freed data.