OESA-2026-4076

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4076
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2026-4076.json
JSON Data
https://api.osv.dev/v1/vulns/OESA-2026-4076
Upstream
CVE (2)
Published
2026-09-25T01:28:08Z
Modified
2026-09-25T01:45:10Z
Severity
  • 7.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS Calculator
Summary
libwebsockets security update
Details

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.(CVE-2026-19773)

A vulnerability classified as critical was found in warmcat libwebsockets 4.5.0. The vulnerability is in the function report_raw_cbor in lib/misc/lecp.c when handling LECP CBOR recordings. This issue allows an out-of-bounds write (CWE-787), which could affect confidentiality, integrity, and availability. A proof-of-concept exploit is available.(CVE-2026-78161)

Database specific 
{
    "severity":  "High"
}
References

Affected packages

openEuler:20.03-LTS-SP4
libwebsockets

Package

Name
libwebsockets
Purl
pkg:rpm/openEuler/libwebsockets&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.0-11.oe2003sp4

Ecosystem specific 

{
    "aarch64":  [
        "libwebsockets-4.3.0-11.oe2003sp4.aarch64.rpm",
        "libwebsockets-debuginfo-4.3.0-11.oe2003sp4.aarch64.rpm",
        "libwebsockets-debugsource-4.3.0-11.oe2003sp4.aarch64.rpm",
        "libwebsockets-devel-4.3.0-11.oe2003sp4.aarch64.rpm"
    ],
    "noarch":  [
        "libwebsockets-help-4.3.0-11.oe2003sp4.noarch.rpm"
    ],
    "src":  [
        "libwebsockets-4.3.0-11.oe2003sp4.src.rpm"
    ],
    "x86_64":  [
        "libwebsockets-4.3.0-11.oe2003sp4.x86_64.rpm",
        "libwebsockets-debuginfo-4.3.0-11.oe2003sp4.x86_64.rpm",
        "libwebsockets-debugsource-4.3.0-11.oe2003sp4.x86_64.rpm",
        "libwebsockets-devel-4.3.0-11.oe2003sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4076.json"
openEuler:22.03-LTS-SP4
libwebsockets

Package

Name
libwebsockets
Purl
pkg:rpm/openEuler/libwebsockets&distro=openEuler-22.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.0-11.oe2203sp4

Ecosystem specific 

{
    "aarch64":  [
        "libwebsockets-4.3.0-11.oe2203sp4.aarch64.rpm",
        "libwebsockets-debuginfo-4.3.0-11.oe2203sp4.aarch64.rpm",
        "libwebsockets-debugsource-4.3.0-11.oe2203sp4.aarch64.rpm",
        "libwebsockets-devel-4.3.0-11.oe2203sp4.aarch64.rpm"
    ],
    "noarch":  [
        "libwebsockets-help-4.3.0-11.oe2203sp4.noarch.rpm"
    ],
    "src":  [
        "libwebsockets-4.3.0-11.oe2203sp4.src.rpm"
    ],
    "x86_64":  [
        "libwebsockets-4.3.0-11.oe2203sp4.x86_64.rpm",
        "libwebsockets-debuginfo-4.3.0-11.oe2203sp4.x86_64.rpm",
        "libwebsockets-debugsource-4.3.0-11.oe2203sp4.x86_64.rpm",
        "libwebsockets-devel-4.3.0-11.oe2203sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4076.json"
openEuler:24.03-LTS-SP1
libwebsockets

Package

Name
libwebsockets
Purl
pkg:rpm/openEuler/libwebsockets&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.3-8.oe2403sp1

Ecosystem specific 

{
    "aarch64":  [
        "libwebsockets-4.3.3-8.oe2403sp1.aarch64.rpm",
        "libwebsockets-debuginfo-4.3.3-8.oe2403sp1.aarch64.rpm",
        "libwebsockets-debugsource-4.3.3-8.oe2403sp1.aarch64.rpm",
        "libwebsockets-devel-4.3.3-8.oe2403sp1.aarch64.rpm"
    ],
    "noarch":  [
        "libwebsockets-help-4.3.3-8.oe2403sp1.noarch.rpm"
    ],
    "src":  [
        "libwebsockets-4.3.3-8.oe2403sp1.src.rpm"
    ],
    "x86_64":  [
        "libwebsockets-4.3.3-8.oe2403sp1.x86_64.rpm",
        "libwebsockets-debuginfo-4.3.3-8.oe2403sp1.x86_64.rpm",
        "libwebsockets-debugsource-4.3.3-8.oe2403sp1.x86_64.rpm",
        "libwebsockets-devel-4.3.3-8.oe2403sp1.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4076.json"
openEuler:24.03-LTS-SP3
libwebsockets

Package

Name
libwebsockets
Purl
pkg:rpm/openEuler/libwebsockets&distro=openEuler-24.03-LTS-SP3

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.3-8.oe2403sp3

Ecosystem specific 

{
    "aarch64":  [
        "libwebsockets-4.3.3-8.oe2403sp3.aarch64.rpm",
        "libwebsockets-debuginfo-4.3.3-8.oe2403sp3.aarch64.rpm",
        "libwebsockets-debugsource-4.3.3-8.oe2403sp3.aarch64.rpm",
        "libwebsockets-devel-4.3.3-8.oe2403sp3.aarch64.rpm"
    ],
    "noarch":  [
        "libwebsockets-help-4.3.3-8.oe2403sp3.noarch.rpm"
    ],
    "src":  [
        "libwebsockets-4.3.3-8.oe2403sp3.src.rpm"
    ],
    "x86_64":  [
        "libwebsockets-4.3.3-8.oe2403sp3.x86_64.rpm",
        "libwebsockets-debuginfo-4.3.3-8.oe2403sp3.x86_64.rpm",
        "libwebsockets-debugsource-4.3.3-8.oe2403sp3.x86_64.rpm",
        "libwebsockets-devel-4.3.3-8.oe2403sp3.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4076.json"
openEuler:24.03-LTS-SP4
libwebsockets

Package

Name
libwebsockets
Purl
pkg:rpm/openEuler/libwebsockets&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.3-8.oe2403sp4

Ecosystem specific 

{
    "aarch64":  [
        "libwebsockets-4.3.3-8.oe2403sp4.aarch64.rpm",
        "libwebsockets-debuginfo-4.3.3-8.oe2403sp4.aarch64.rpm",
        "libwebsockets-debugsource-4.3.3-8.oe2403sp4.aarch64.rpm",
        "libwebsockets-devel-4.3.3-8.oe2403sp4.aarch64.rpm"
    ],
    "noarch":  [
        "libwebsockets-help-4.3.3-8.oe2403sp4.noarch.rpm"
    ],
    "src":  [
        "libwebsockets-4.3.3-8.oe2403sp4.src.rpm"
    ],
    "x86_64":  [
        "libwebsockets-4.3.3-8.oe2403sp4.x86_64.rpm",
        "libwebsockets-debuginfo-4.3.3-8.oe2403sp4.x86_64.rpm",
        "libwebsockets-debugsource-4.3.3-8.oe2403sp4.x86_64.rpm",
        "libwebsockets-devel-4.3.3-8.oe2403sp4.x86_64.rpm"
    ]
}

Database specific

source 
"https://repo.openeuler.org/security/data/osv/OESA-2026-4076.json"