USN-8893-1: Libwebsockets vulnerabilities
Ubuntu fixed two libwebsockets buffer overflows that could crash systems or run code.
Ubuntu Security Notice USN-8893-1 covers two libwebsockets vulnerabilities. CVE-2026-19773 is improper validation of user data in HTTP/2 HPACK path headers, which can write past an allocated buffer and possibly allow arbitrary code execution. CVE-2026-78161 is incorrect CBOR recording in the LECP parser, which can write past a buffer and cause a crash or possible code execution. The notice does not report in-the-wild exploitation.
- CVE-2026-19773: HTTP/2 HPACK path parsing can overflow a buffer.
- CVE-2026-78161: LECP CBOR recording can crash the process or run code.
- Ubuntu does not report either flaw as exploited.
- Vendors
- Ubuntu
- Products
- libwebsockets
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19773 | Unauthenticated RCE via HTTP/2 HPACK Path Header Parsing in libwebsockets | 9.8 | — | ||
| CVE-2026-78161 | A vulnerability was found in warmcat libwebsockets 4.5.0 | 5.5 | <1% |
From the original article
It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2 HPACK path headers, which could result in a write past the end of an allocated buffer. An attacker could possibly use this issue to execute arbitrary code.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.