Quick answers
- Is CVE-2026-95114 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-95114 being exploited in the wild.
- How severe is CVE-2026-95114?
- High severity, with a CVSS score of 7.5, published 13 October 2026.
- Which products and versions are affected?
- Warmcat Libwebsockets before fix commit 736a4a26fce344766bc6618df87bf32193829dd0.
- Is there a fix for CVE-2026-95114?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-95114 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-95114?
- Check whether you run Warmcat Libwebsockets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The LEJP incremental parser in lib/misc/lejp.c fails to properly roll back the stack pointer (ctx->sp) when rejecting stack overflow, leaving it at position 64 (one past the valid 63-entry boundary). On the next call to lejp_parse(), the function unconditionally reads ctx->st[ctx->sp], resulting in an out-of-bounds read of ctx->st[64]. This is a remote vulnerability requiring only network access to send malicious JSON to a vulnerable application.
Affected products
- warmcat libwebsockets before fix commit 736a4a26fce344766bc6618df87bf32193829dd0
Timeline
- 2026-10-13: disclosed
- 2026-10-10: other: vulnerability details disclosed on GitHub