OESA-2026-4615: libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libwebsocketsto a version that resolves this vulnerability.Fixed in 4.3.0-12.oe2203sp4
Event History
Frequently Asked Questions
What access does an attacker need to exploit these issues?
The vulnerabilities are remotely exploitable and require no privileges or user interaction. An attacker would need to reach functionality that processes input using the affected LEJP JSON parser.
What is the expected impact of successful exploitation?
Both issues can be used to cause a denial of service. The provided severity vector indicates availability impact without stated confidentiality or integrity impact.