OESA-2026-4741: libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):
libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.(CVE-2026-114550)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/libwebsocketsto a version that resolves this vulnerability.Fixed in 4.3.3-10.oe2403sp4 - Upgrade
Upgrade
libwebsocketsto a version that resolves this vulnerability.Patch CVE-2026-114550
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need authentication. Exploitation requires the attacker to send a crafted MQTT PUBACK packet to an affected libwebsockets installation.
What level of access could successful exploitation provide?
Successful exploitation can allow remote code execution in the context of the current process. The reported impact includes potential compromise of confidentiality, integrity, and availability.
How can I determine whether my deployment is exposed?
Review whether your application uses the openEuler libwebsockets package and handles MQTT PUBACK packets through libwebsockets. The provided information does not identify affected package versions or configuration-specific conditions.