libwebsockets MQTT PUBACK handling flaw allows unauthenticated RCE
ZDI rates CVE-2026-114550 at 8.1; no login is required, and no fixed version is named.
58
Product
libwebsockets
- Mentions · 7d1
- Mentions · 30d2
- All mentions4
- First seenAug 24, 2026
- Last mentioned4d ago
Timeline
4 articles · newest firstUSN-8893-1: Libwebsockets vulnerabilities
Ubuntu fixed two libwebsockets buffer overflows that could crash systems or run code.
34
USN-8822-1: Libwebsockets vulnerabilities
Ubuntu's Libwebsockets update covers a resource-exhaustion flaw and a CBOR bug that may allow code execution.
46
ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-19773, an unauthenticated out-of-bounds write allowing remote code execution in libwebsockets HTTP/2 HPACK parsing, rated CVSS 9.8.
60
Related CVEs
by mentions- Unauthenticated RCE via HTTP/2 HPACK Path Header Parsing in libwebsockets
- CVE-2026-78161<1%5.5A vulnerability was found in warmcat libwebsockets 4.5.0
- CVE-2026-10650<1%5.5A flaw has been found in warmcat libwebsockets up to 4.5.8
Appears with
- Canonicalorganization · 1
- Zero Day Initiativeorganization · 1
- Zero Day Initiativevendor · 1
- Ubuntuproduct · 1
- Canonicalvendor · 1
- Ubuntuvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.