OESA-2026-4695: libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):
A vulnerability classified as critical has been found in libwebsockets (affected version unknown). CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-114550)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libwebsocketsto a version that resolves this vulnerability.Fixed in 4.3.3-10.oe2403sp1
Event History
Frequently Asked Questions
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates that no privileges and no user interaction are required. Exploitation is rated as having high attack complexity and network access.
Can I determine whether a particular libwebsockets version is affected?
No. The affected version or versions are not identified in the available advisory data, so version-based exposure determination is not possible from this information alone.
What can be done if an update cannot be applied immediately?
No countermeasures or temporary mitigations are documented in the available data. The advisory notes that replacing the affected object with an alternative product may be suggested.