Remote Code Execution Vulnerability in libwebsockets by Warmcat
CVE-2026-19773

9.8CRITICAL

Key Information:

Vendor

Libwebsockets

Status
Libwebsockets
Vendor
CVE Published:
15 September 2026

What is CVE-2026-19773?

A vulnerability exists in libwebsockets related to the parsing of HTTP/2 HPACK path headers. This flaw arises from inadequate validation of user-supplied data, which may lead to an out-of-bounds write scenario. By exploiting this vulnerability, remote attackers could execute arbitrary code within the context of the affected process, potentially compromising system integrity. Since no authentication is needed for exploitation, this issue poses a serious risk to installations running unpatched versions.

Affected Version(s)

libwebsockets b4b5aed3903eaff09cd76a410f69bbe5dff66f8e

References

https://www.zerodayinitiative.com/advisories/ZDI-26-590/
x_research-advisory
https://github.com/warmcat/libwebsockets/commit/824151862...
vendor-advisory

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.