OESA-2026-4741

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2026-4741

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2026-4741.json

JSON Data

https://api.osv.dev/v1/vulns/OESA-2026-4741

Upstream

CVE-2026-114550

Published

2026-11-11T12:25:43Z

Modified

2026-11-11T12:45:04Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

libwebsockets security update

Details

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets MQTT Protocol PUBACK Packet Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of PUBACK packets. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31039.(CVE-2026-114550)

Database specific

{
    "severity": "High"
}

References

Affected packages

openEuler:24.03-LTS-SP4 / libwebsockets

Package

Name: libwebsockets
Purl: pkg:rpm/openEuler/libwebsockets&distro=openEuler-24.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

4.3.3-10.oe2403sp4

Ecosystem specific

{
    "aarch64": [
        "libwebsockets-4.3.3-10.oe2403sp4.aarch64.rpm",
        "libwebsockets-debuginfo-4.3.3-10.oe2403sp4.aarch64.rpm",
        "libwebsockets-debugsource-4.3.3-10.oe2403sp4.aarch64.rpm",
        "libwebsockets-devel-4.3.3-10.oe2403sp4.aarch64.rpm"
    ],
    "noarch": [
        "libwebsockets-help-4.3.3-10.oe2403sp4.noarch.rpm"
    ],
    "src": [
        "libwebsockets-4.3.3-10.oe2403sp4.src.rpm"
    ],
    "x86_64": [
        "libwebsockets-4.3.3-10.oe2403sp4.x86_64.rpm",
        "libwebsockets-debuginfo-4.3.3-10.oe2403sp4.x86_64.rpm",
        "libwebsockets-debugsource-4.3.3-10.oe2403sp4.x86_64.rpm",
        "libwebsockets-devel-4.3.3-10.oe2403sp4.x86_64.rpm"
    ]
}

Database specific

source

"https://repo.openeuler.org/security/data/osv/OESA-2026-4741.json"