libwebsockets MQTT PUBACK handling flaw allows unauthenticated RCE
ZDI rates CVE-2026-114550 at 8.1; no login is required, and no fixed version is named.
Stories per day · 30 days
3 RSS
4 stories, newest first · one card per story
Stories tagged #libwebsockets
USN-8893-1: Libwebsockets vulnerabilities
Ubuntu fixed two libwebsockets buffer overflows that could crash systems or run code.
USN-8822-1: Libwebsockets vulnerabilities
Ubuntu's Libwebsockets update covers a resource-exhaustion flaw and a CBOR bug that may allow code execution.
ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-19773, an unauthenticated out-of-bounds write allowing remote code execution in libwebsockets HTTP/2 HPACK parsing, rated CVSS 9.8.