ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Aug 24, 2026

Updated

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19773.

Affected Software

1 affected component

libwebsockets

Event History

Aug 24, 2026

Advisory Published

via ZDI·05:00 AM

Data Sourced

via ZDI·05:00 AM

Description

Frequently Asked Questions

Which deployments should be prioritized for investigation and remediation?

Affected libwebsockets installations that can be reached by remote attackers should be prioritized, because exploitation does not require authentication and can result in arbitrary code execution.

What identifier should be used to track this issue across vulnerability-management systems?

Track the issue as CVE-2026-19773. The advisory identifier is ZDI-26-590.

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments should be prioritized for investigation and remediation?

What identifier should be used to track this issue across vulnerability-management systems?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for investigation and remediation?

What identifier should be used to track this issue across vulnerability-management systems?