CVE-2026-50161: libre: Integer overflow in websock_decode() masked frame length check leads to heap buffer overflow
libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websockdecode() function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64MAX, causing the mbufgetleft() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer. Applications using websockaccept() or websockacceptproto() to implement a WebSocket server are affected, and exploitation can cause attacker-controlled heap corruption or denial of service after the HTTP WebSocket upgrade handshake. This issue is fixed in version 4.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libreto a version that resolves this vulnerability.Fixed in 4.8.1
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications that use websock_accept() or websock_accept_proto() to implement a WebSocket server are affected if they use libre versions before 4.8.1. The issue is reachable after an HTTP WebSocket upgrade handshake.
What does an attacker need to exploit this issue?
An attacker needs to complete the HTTP WebSocket upgrade handshake and send a masked WebSocket frame using the 64-bit extended-length encoding with a length near UINT64_MAX. This can cause the frame-length validation to wrap and allow out-of-bounds writes during XOR unmasking.
What is the remediation?
Upgrade libre to version 4.8.1, which fixes the issue. The provided data does not identify an alternative mitigation for environments that cannot upgrade immediately.