CVE-2026-95115

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-95115
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95115.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-95115
Downstream
Published
2026-10-13T00:00:00Z
Modified
2026-10-15T07:08:50Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95115.json"
}
References

Affected packages

Git / github.com/warmcat/libwebsockets

Affected ranges

Type
GIT
Repo
https://github.com/warmcat/libwebsockets
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
736a4a26fce344766bc6618df87bf32193829dd0
Fixed
c404a205a98323a7f60e69fae532c5d26bf4a62a
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

Other
deflate-stream-support
master-test-2015-11-06-1
master-test-2015-11-19-1
sai-0300e5ac0
sai-0384a8650
sai-045415dbe
sai-074875fbf
sai-0a2b28ad4
sai-1a749fcc4
sai-1c0e0a309
sai-206bec3b4
sai-25355ce4c
sai-2787ec61a
sai-4e59faf9d
sai-5a510c46b
sai-5a86bc7d9
sai-5e7b2a70a
sai-608cc00ee
sai-64bd3b755
sai-6e1eaa96a
sai-72c29c450
sai-72efe529f
sai-7b26c3fed
sai-84d81cbb3
sai-882ca3fe6
sai-921f90ffb
sai-9cc5ef2ac
sai-9e1c70ac4
sai-b06d43b77
sai-b1c687cea
sai-bc69b6beb
sai-c5e00391b
sai-cbfd75cb9
sai-d56159af6
sai-d775ea44e
sai-d7e586cee
sai-dc772a47a
support-chrome-20-firefox-12
support-protocol-v7
support-protocol-v8-chrome-15-firefox-6
valgrind-clean
release-0.*
release-0.1
release-0.2
release-0.3
release-0.4
release-0.5
release-0.6
v1.*
v1.0-chrome25-firefox17
v1.1-chrome26-firefox18
v1.2-chrome26-firefox18
v1.21-chrome26-firefox18
v1.22-chrome26-firefox18
v1.23-chrome32-firefox24
v1.3-chrome37-firefox30
v1.4-chrome43-firefox-36
v1.5-chrome47-firefox41
v1.6.0-chrome48-firefox42
v1.7.0
v2.*
v2.0.0
v2.1-pre3
v2.1.0
v2.2.0
v2.3.0
v2.4.0
v3.*
v3.0.0
v3.1.0
v4.*
v4.0.0
v4.1.0
v4.2-rc1
v4.2.0
v4.3.0
v4.4.0
v4.5.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95115.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "270892201335218956877967915364102700925",
            "length":  15755
        },
        "id":  "CVE-2026-95115-17d27899",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a",
        "target":  {
            "file":  "lib/misc/lejp.c",
            "function":  "lejp_parse"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238143084788085900580323416887858130306",
                "50692394739208856651802219510088445033",
                "84927927127821115520065404557642942136",
                "215494834799152321771280630691095153392",
                "23930286718403568619887457473133190642",
                "279662707477426691791592756852708769748",
                "261157938023675953066928776189336140187",
                "146365533193777545944859907769769510814",
                "210705794846820539323546467241869874773",
                "303715639102360373361580253827261003631",
                "74369676365486498722215044527873369233",
                "101751406264422365901163837267211457077",
                "201462836966459058190968225557110523107",
                "106250221530682654264277443301668714021",
                "261157938023675953066928776189336140187",
                "145002801260366139247904137437741094657",
                "45972145194831362185678579677333221389",
                "280704518195769042487549686346696964349",
                "110970410540041278624355412463155789395",
                "222506981460656242529920301688731483871",
                "201462836966459058190968225557110523107",
                "106250221530682654264277443301668714021",
                "261157938023675953066928776189336140187",
                "145002801260366139247904137437741094657",
                "45972145194831362185678579677333221389",
                "280704518195769042487549686346696964349",
                "330439790753133295779882025654484399572",
                "42842076680187731675439441380365460449",
                "277449606410721350791398736905130241494",
                "106250221530682654264277443301668714021",
                "261157938023675953066928776189336140187",
                "146365533193777545944859907769769510814",
                "107845757361920713018752043747234677478",
                "28667609403046601959246165512656579609",
                "11644975227428233148294583654352896033",
                "130261494007937786473209827363924705042",
                "261864398158834914135966859285377489395",
                "85888651119426938046830556126205731213",
                "230536542597687635486829012182910137047",
                "219133545051982942496331186979895779724",
                "126695880029921635805203733829690013891"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-95115-49f8677c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a",
        "target":  {
            "file":  "lib/misc/lejp.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "270892201335218956877967915364102700925",
            "length":  15755
        },
        "id":  "CVE-2026-95115-d91110f5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0",
        "target":  {
            "file":  "lib/misc/lejp.c",
            "function":  "lejp_parse"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "238143084788085900580323416887858130306",
                "50692394739208856651802219510088445033",
                "84927927127821115520065404557642942136",
                "215494834799152321771280630691095153392",
                "23930286718403568619887457473133190642",
                "279662707477426691791592756852708769748",
                "261157938023675953066928776189336140187",
                "146365533193777545944859907769769510814",
                "210705794846820539323546467241869874773",
                "303715639102360373361580253827261003631",
                "74369676365486498722215044527873369233",
                "101751406264422365901163837267211457077",
                "201462836966459058190968225557110523107",
                "106250221530682654264277443301668714021",
                "261157938023675953066928776189336140187",
                "145002801260366139247904137437741094657",
                "45972145194831362185678579677333221389",
                "280704518195769042487549686346696964349",
                "110970410540041278624355412463155789395",
                "222506981460656242529920301688731483871",
                "201462836966459058190968225557110523107",
                "106250221530682654264277443301668714021",
                "261157938023675953066928776189336140187",
                "145002801260366139247904137437741094657",
                "45972145194831362185678579677333221389",
                "280704518195769042487549686346696964349",
                "330439790753133295779882025654484399572",
                "42842076680187731675439441380365460449",
                "277449606410721350791398736905130241494",
                "106250221530682654264277443301668714021",
                "261157938023675953066928776189336140187",
                "146365533193777545944859907769769510814",
                "107845757361920713018752043747234677478",
                "28667609403046601959246165512656579609",
                "11644975227428233148294583654352896033",
                "130261494007937786473209827363924705042",
                "261864398158834914135966859285377489395",
                "85888651119426938046830556126205731213",
                "230536542597687635486829012182910137047",
                "219133545051982942496331186979895779724",
                "126695880029921635805203733829690013891"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-95115-f06840aa",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0",
        "target":  {
            "file":  "lib/misc/lejp.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-15T07:08:50Z"