CVE-2025-11677: Use After Free in libwebsockets WebSocket server

Published Oct 20, 2025

Updated

Use After Free in WebSocket server implementation in lwshandshakeserver in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWSCALLBACKHTTPCONFIRMUPGRADE, to achieve denial of service.

Affected Software

1 affected component

warmcat libwebsockets

Remediation

Information

Update the library to its latest stable release, if not possible backport the fix commit 2f082ec31261f556969160143ba94875d783971a

Event History

Oct 20, 2025

CVE Published

via MITRE·01:41 PM

Data Sourced

via MITRE·01:41 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·02:15 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-11677?

CVE-2025-11677 is classified as a denial of service vulnerability.

How do I fix CVE-2025-11677?

To fix CVE-2025-11677, ensure that your implementation of the WebSocket server does not use user-defined callback functions that handle LWS_CALLBACK_HTTP_CONFIRM_UPGRADE.

What causes CVE-2025-11677?

CVE-2025-11677 is caused by a use after free condition in the WebSocket server implementation when specific user-provided callback configurations are used.

Which software is affected by CVE-2025-11677?

CVE-2025-11677 affects the warmcat libwebsockets software library.

Can CVE-2025-11677 be exploited remotely?

Yes, CVE-2025-11677 can potentially be exploited remotely if the vulnerable configurations are in place.