A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libwebsockets | Sep 21, 2026 | Jun 2, 2026 |
| Ubuntu | — | Upgrade libwebsockets19t64 (Ubuntu Pro)Upgrade libwebsockets15 (Ubuntu Pro)Upgrade libwebsockets-dev (Ubuntu Pro)Upgrade libwebsockets-devUpgrade libwebsockets-evlib-ev (Ubuntu Pro)Upgrade libwebsockets16 (Ubuntu Pro)Upgrade libwebsockets-test-server (Ubuntu Pro)Upgrade libwebsockets-test-server-commonUpgrade libwebsockets-evlib-evUpgrade libwebsockets19t64Upgrade libwebsockets-test-serverUpgrade libwebsockets-evlib-uv (Ubuntu Pro)Upgrade libwebsockets-evlib-glib (Ubuntu Pro)Upgrade libwebsockets-evlib-glibUpgrade libwebsockets-test-server-common (Ubuntu Pro)Upgrade libwebsockets-evlib-uv | Sep 28, 2026 | Sep 25, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub