Executive brief
libwebsockets is an open-source WebSocket and HTTP server library used in many embedded systems and applications to handle network communication. A flaw in its HTTP/2 HPACK header parsing allows remote attackers to write data past the end of a buffer, enabling them to execute arbitrary code without needing authentication. This could allow complete compromise of any system running vulnerable versions.
Technical details
The vulnerability exists in the HTTP/2 HPACK path header parsing logic within lib/roles/h2/hpack.c. The root cause is insufficient validation of user-supplied header data, leading to an out-of-bounds write in the allocated header buffer. The flaw occurs in the lws_frag_append() function, which did not check if the buffer position exceeded the maximum allowed header data size before writing. An attacker can exploit this via a crafted HTTP/2 request sent over the network without authentication. The exploit allows arbitrary code execution in the context of the libwebsockets process. A patch is available in the upstream repository that adds bounds checking before the buffer write operation.
Affected products
- libwebsockets libwebsockets
Timeline
- 2026-07-03: disclosed: Vulnerability reported to vendor
- 2026-08-24: patched: Coordinated public release and patch available
- 2026-08-24: advisory: ZDI-26-590 advisory published