USN-8822-1: Libwebsockets vulnerabilities
Ubuntu's Libwebsockets update covers a resource-exhaustion flaw and a CBOR bug that may allow code execution.
Ubuntu published USN-8822-1 for Libwebsockets. CVE-2026-10650 is improper handling of certain SSH protocol messages that a remote attacker could use to consume excessive resources and cause a denial of service. CVE-2026-78161, affecting Ubuntu 24.04 LTS and 26.04 LTS, involves malformed CBOR that can crash the library or allow arbitrary code execution. The notice does not report exploitation in the wild.
- CVE-2026-10650 lets crafted SSH messages exhaust resources
- CVE-2026-78161 malformed CBOR can crash Libwebsockets or enable code execution
- The code-execution issue affects Ubuntu 24.04 LTS and 26.04 LTS
- The notice does not report active exploitation
- Vendors
- Canonical
- Products
- LibwebsocketsUbuntu
- Organizations
- Canonical
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-10650 | A flaw has been found in warmcat libwebsockets up to 4.5.8 | 5.5 | <1% | ||
| CVE-2026-78161 | A vulnerability was found in warmcat libwebsockets 4.5.0 | 5.5 | <1% |
From the original article
It was discovered that Libwebsockets incorrectly handled certain SSH protocol messages in its SSH protocol handler. A remote attacker could possibly use this issue to cause Libwebsockets to consume excessive resources, resulting in a denial of service. (CVE-2026-10650) It was discovered that Libwebsockets incorrectly handled certain malformed CBOR data.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.