# CVE-2026-19773: libwebsockets HTTP/2 HPACK path header out-of-bounds write RCE

Source: https://junglewise.ai/threats/cve-2026-19773-libwebsockets-http-2-hpack-path-header-out-of-bounds-write-rce  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-19773 · Severity: critical · CVSS 9.8 · Published 2026-09-15

libwebsockets is an open-source WebSocket and HTTP server library used in many embedded systems and applications to handle network communication. A flaw in its HTTP/2 HPACK header parsing allows remote attackers to write data past the end of a buffer, enabling them to execute arbitrary code without needing authentication. This could allow complete compromise of any system running vulnerable versions.

## Quick answers

**Is CVE-2026-19773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-19773 being exploited in the wild.

**How severe is CVE-2026-19773?** Critical severity, with a CVSS score of 9.8, published 15 September 2026.

**Which products and versions are affected?** libwebsockets libwebsockets.

**Is there a fix for CVE-2026-19773?** A patch was published on 2026-08-24: Coordinated public release and patch available Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-19773 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-19773?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the HTTP/2 HPACK path header parsing logic within lib/roles/h2/hpack.c. The root cause is insufficient validation of user-supplied header data, leading to an out-of-bounds write in the allocated header buffer. The flaw occurs in the lws_frag_append() function, which did not check if the buffer position exceeded the maximum allowed header data size before writing. An attacker can exploit this via a crafted HTTP/2 request sent over the network without authentication. The exploit allows arbitrary code execution in the context of the libwebsockets process. A patch is available in the upstream repository that adds bounds checking before the buffer write operation.

## Affected products

- libwebsockets libwebsockets

## Timeline

- 2026-07-03: disclosed: Vulnerability reported to vendor
- 2026-08-24: patched: Coordinated public release and patch available
- 2026-08-24: advisory: ZDI-26-590 advisory published

## References

- [https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b](https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b)
- [https://www.zerodayinitiative.com/advisories/ZDI-26-590/](https://www.zerodayinitiative.com/advisories/ZDI-26-590/)