OESA-2026-4614: libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libwebsocketsto a version that resolves this vulnerability.Fixed in 4.3.3-9.oe2403sp4
Event History
Frequently Asked Questions
What impact can an unauthenticated remote attacker have?
Both listed issues can be exploited remotely without authentication or user interaction to cause a denial of service. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.
Which component should be prioritized for remediation?
Prioritize systems using the openEuler libwebsockets package, particularly where the application processes remotely supplied JSON through the LEJP parser. The reported flaws are in the LEJP incremental parser and LEJP JSON parser.
How can teams determine whether they are affected?
Identify deployments that include the openEuler libwebsockets package and determine whether their applications use the LEJP JSON parsing functionality. The advisory data does not provide affected or fixed package versions, so version-based exposure cannot be determined from this information.