ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2026-19773 is a critical (CVSS 9.8) out-of-bounds write in libwebsockets' HTTP/2 HPACK decoder, disclosed by Trend Micro's Zero Day Initiative as ZDI-26-590. When libwebsockets decodes the HTTP/2 :path pseudo-header from a HPACK-compressed request, it fails to properly validate the length of user-supplied data before writing it into an allocated buffer, allowing a write past the end of that buffer. A remote, unauthenticated attacker can trigger this simply by sending a crafted HTTP/2 request to a vulnerable service, and successful exploitation yields arbitrary code execution in the context of the affected process. Any product or service that embeds libwebsockets and has HTTP/2 support enabled is potentially affected, including embedded devices, IoT firmware, and lightweight WebSocket-capable servers. No public proof-of-concept is known, the flaw is not on the CISA KEV list, and there is no indication of in-the-wild exploitation at this time.

Do: Upgrade libwebsockets to the fixed release identified in ZDI-26-590 as soon as it is available, and contact your vendor or check firmware updates for any third-party product that embeds libwebsockets. Until a patch can be applied, disable HTTP/2 support and fall back to HTTP/1.1 where possible, or restrict and filter access to affected services at the network edge. Monitor HTTP/2 traffic for malformed or oversized :path pseudo-headers and abnormal process behavior on hosts running libwebsockets-based services.