OESA-2026-4694: libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):
A vulnerability classified as critical has been found in libwebsockets (affected version unknown). CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-114550)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libwebsocketsto a version that resolves this vulnerability.Fixed in 4.3.0-13.oe2203sp4
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
The vulnerability is remotely exploitable over the network and does not require authentication, privileges, or user interaction. The attack complexity is rated high.
Which deployments should be prioritized for investigation?
Prioritize systems that use the openEuler libwebsockets package in network-reachable services, because the reported impact includes compromise of confidentiality, integrity, and availability.
Can affected systems be identified by package version?
No affected version range is provided in the available data. Determine whether the system uses the listed libwebsockets package and track the referenced security bulletin for version-specific remediation information.
Is a workaround available if patching cannot be performed immediately?
No countermeasures or workaround are identified in the available information. The advisory notes that replacing the affected object with an alternative product may be considered.