Unauthenticated RCE via HTTP/2 HPACK Path Header Parsing in libwebsockets
CVE-2026-19773 is a critical (CVSS 9.8) out-of-bounds write in libwebsockets' HTTP/2 HPACK decoder, disclosed by Trend Micro's Zero Day Initiative as ZDI-26-590. When libwebsockets decodes the HTTP/2 :path pseudo-header from a HPACK-compressed request, it fails to properly validate the length of user-supplied data before writing it into an allocated buffer, allowing a write past the end of that buffer. A remote, unauthenticated attacker can trigger this simply by sending a crafted HTTP/2 request to a vulnerable service, and successful exploitation yields arbitrary code execution in the context of the affected process. Any product or service that embeds libwebsockets and has HTTP/2 support enabled is potentially affected, including embedded devices, IoT firmware, and lightweight WebSocket-capable servers. No public proof-of-concept is known, the flaw is not on the CISA KEV list, and there is no indication of in-the-wild exploitation at this time.
What to do: Upgrade libwebsockets to the fixed release identified in ZDI-26-590 as soon as it is available, and contact your vendor or check firmware updates for any third-party product that embeds libwebsockets. Until a patch can be applied, disable HTTP/2 support and fall back to HTTP/1.1 where possible, or restrict and filter access to affected services at the network edge. Monitor HTTP/2 traffic for malformed or oversized :path pseudo-headers and abnormal process behavior on hosts running libwebsockets-based services.
| Product | Affected |
|---|---|
| libwebsockets project (warmcat) libwebsockets | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.
ZDI disclosed CVE-2026-19773, an unauthenticated out-of-bounds write allowing remote code execution in libwebsockets HTTP/2 HPACK parsing, rated CVSS 9.8.
Ubuntu fixed two libwebsockets buffer overflows that could crash systems or run code.
Today 853 readers · 1.1K views · 855 reads · all time 159K views