OESA-2026-4696: libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):
A vulnerability classified as critical has been found in libwebsockets (affected version unknown). CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.(CVE-2026-114550)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libwebsocketsto a version that resolves this vulnerability.Fixed in 4.3.3-10.oe2403sp3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the openEuler libwebsockets package may be exposed. The affected libwebsockets version range is not provided, so the available data does not establish which installed versions are vulnerable.
Does exploitation require authentication or user interaction?
The supplied vector indicates that exploitation is network-accessible and requires no privileges or user interaction. It also indicates high attack complexity.
What is the impact if exploitation succeeds?
The issue is classified as CWE-787, involving writes outside the intended buffer boundary. The provided severity vector rates confidentiality, integrity, and availability impact as high.
What mitigation is available if patching cannot be performed immediately?
No countermeasures are identified in the available advisory data. It suggests replacing the affected object with an alternative product, but does not provide a specific alternative or workaround.