CVE-2026-95114: High severity libwebsockets libwebsockets vulnerability
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs the ability to send input that is processed by the LEJP incremental parser. The described impact is a remote denial of service caused by an out-of-bounds read.
How can I determine whether my deployment is exposed?
Review whether your application uses libwebsockets and invokes the LEJP incremental parser on remotely supplied data. The provided information does not identify affected versions or specific default configurations.
What can be done if updating is not immediately possible?
Limit or block untrusted remote input from reaching code paths that use the LEJP incremental parser, where operationally feasible. Monitor affected services for crashes or availability disruptions associated with parser input.