CVE-2026-95114 Details
Description
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service
A denial-of-service vulnerability has been identified in libwebsockets, specifically within the LEJP incremental parser located in 'lib/misc/lejp.c'. This vulnerability arises from an out-of-bounds read condition that a remote attacker can exploit. The issue occurs when the parser's stack overflows, leaving the parser context in a state that allows for reading beyond the allocated memory, which can lead to undefined behavior and a crash.
Users can update to the latest version of libwebsockets, where this vulnerability has been fixed. Instructions for updating can be found in the libwebsockets repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 13, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/warmcat/libwebsockets/issues/3664 | CISA-ADP | Issue TrackingTechnical DescriptionVendor |
| https://gist.github.com/1820893135-pixel/34d3bc35f74eb0807e73b1df3f15af42 | [email protected] | Technical Description |
| https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0 | [email protected] | Source CodeVendor |
| https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a | [email protected] | Source CodeVendor |
| https://github.com/warmcat/libwebsockets/issues/3664 | [email protected] | Issue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-125 | Out-of-bounds Read | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| libwebsockets | 106d542c7 |
CPE
Remediation | |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 13, 2026 | New CVE Received | [email protected] |