Use After Free in libwebsockets WebSocket server
Priority LOW 28CWE-416Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Deferred Red Hat: fix deferred
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.
Summary
Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00405 34th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Interconnect 1 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 16.2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 17.1 | Affected | No fix yet: Fix deferred |
| Red Hat Service Interconnect 2 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2025-11677
- 2026-10-03 Alias added: GHSA-fpc8-25p9-jfmr
References
More warmcat vulnerabilities
- TI-2026-54362 warmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds write CVSS 4.0MEDIUM 6.9
- TI-2026-09152 warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption CVSS 4.0MEDIUM 6.9
- TI-2025-01611 Undefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsockets CVSS 4.0CRITICAL 10.0
- TI-2025-10708 Stack-based Buffer Overflow in libwebsockets DNS response parsing CVSS 4.0HIGH 7.5
- TI-2025-10710 Out-of-bounds Write in libwebsockets PNG parsing CVSS 4.0MEDIUM 5.9
- TI-2025-10709 Out-of-bounds Read in libwebsockets PNG parsing CVSS 4.0MEDIUM 5.9
Sources
- CVE-2025-11677 · CVE Program
- CVE-2025-11677 · NVD
- FIRST EPSS
- GHSA-fpc8-25p9-jfmr · GitHub Advisory Database · CC BY 4.0
- CVE-2025-11677 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences