OESA-2026-4616: libwebsockets security update

Q: Who can exploit these issues?

A remote attacker can exploit the vulnerabilities. No privileges or user interaction are required, according to the supplied severity vector.

Q: What is the expected impact?

Both issues can cause denial of service. The described flaws are an out-of-bounds read in the LEJP incremental parser and a buffer overflow involving the LEJP JSON parser.

Q: Which component should be checked for exposure?

Check systems using the openEuler libwebsockets package, particularly applications that process remotely supplied JSON through the LEJP parser.

Published Oct 29, 2026

Updated

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Affected Software

1 affected componentFixes available

openeuler/libwebsockets<4.3.3-9.oe2403sp1

4.3.3-9.oe2403sp1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openeuler/libwebsockets to a version that resolves this vulnerability.
Fixed in 4.3.3-9.oe2403sp1

Event History

Oct 29, 2026

Advisory Published

via OSV·09:03 AM

Data Sourced

via OSV·09:03 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Who can exploit these issues?

A remote attacker can exploit the vulnerabilities. No privileges or user interaction are required, according to the supplied severity vector.

What is the expected impact?

Both issues can cause denial of service. The described flaws are an out-of-bounds read in the LEJP incremental parser and a buffer overflow involving the LEJP JSON parser.

Which component should be checked for exposure?

Check systems using the openEuler libwebsockets package, particularly applications that process remotely supplied JSON through the LEJP parser.

OESA-2026-4616: libwebsockets security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit these issues?

What is the expected impact?

Which component should be checked for exposure?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit these issues?

What is the expected impact?

Which component should be checked for exposure?