Description
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| warmcat | libwebsockets | 4.5.0, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 4.5.5, 4.5.6, 4.5.7, 4.5.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libwebsockets | 4.3.5-5 | — |
| Debian 13 | libwebsockets | 4.3.5-1+deb13u2 | — |
| Debian 12 | libwebsockets | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | libwebsockets | 4.3.5-3ubuntu1.1 | USN-8822-1 |
| Ubuntu 25.10 | libwebsockets | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | libwebsockets | 4.3.3-1.1ubuntu0.1~esm2 | USN-8822-1 |
| Ubuntu Pro 22.04 LTS | libwebsockets | 4.0.20-2ubuntu1.1+esm1 | USN-8822-1 |
| Ubuntu Pro 20.04 LTS | libwebsockets | 3.2.1-3ubuntu0.1~esm2 | USN-8822-1 |
Advisories 1
- USN-8822-1 libwebsockets vulnerabilities Ubuntu Security Notices (USN) · Sep 28, 2026
References
- VDB-367955 | warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption vdb-entry technical-description
- VDB-367955 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-10650 | CVE Analysis and Report third-party-advisory
- Submit #830261 | warmcat libwebsockets 4.5.99-v4.5.0-382-g4a63b9333 Uncontrolled Memory Allocation third-party-advisory
- https://github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded-alloc exploit
- https://github.com/biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded-alloc/poc_sshd_unbounded_alloc.py exploit
- https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 patch
- https://github.com/warmcat/libwebsockets/ product