OESA-2026-4613: libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libwebsocketsto a version that resolves this vulnerability.Fixed in 4.3.3-9.oe2403sp3
Event History
Frequently Asked Questions
What can an unauthenticated attacker do?
A remote attacker can trigger a denial of service through flaws in the LEJP incremental and JSON parsers. No authentication or user interaction is required according to the supplied severity vector.
Which component should teams assess for exposure?
Teams should assess applications that use libwebsockets and process remotely supplied data through the LEJP parser. The affected software package is openeuler/libwebsockets.
Are confidentiality or integrity impacts indicated?
No. The supplied severity vector identifies high availability impact, while confidentiality and integrity impacts are listed as none.