CVE-2025-11678: Stack-based Buffer Overflow in libwebsockets DNS response parsing
Stack-based Buffer Overflow in lwsadnsparselabel in warmcat libwebsockets allows, when the LWSWITHSYSASYNCDNS flag is enabled during compilation, to overflow the labelstack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11678?
CVE-2025-11678 is classified as a high severity vulnerability due to its potential for causing stack-based buffer overflow.
How do I fix CVE-2025-11678?
To fix CVE-2025-11678, disable the LWS_WITH_SYS_ASYNC_DNS flag during compilation or update to a patched version of warmcat libwebsockets.
What causes CVE-2025-11678?
CVE-2025-11678 is caused by a stack-based buffer overflow in the lws_adns_parse_label function when processing crafted DNS responses.
Which versions of warmcat libwebsockets are affected by CVE-2025-11678?
CVE-2025-11678 affects versions of warmcat libwebsockets that have the LWS_WITH_SYS_ASYNC_DNS flag enabled during compilation.
Can CVE-2025-11678 lead to remote code execution?
Yes, CVE-2025-11678 can potentially lead to remote code execution allowing attackers to compromise affected systems.