# CVE-2026-95114: libwebsockets out-of-bounds read in LEJP parser

Source: https://junglewise.ai/threats/cve-2026-95114-libwebsockets-contains-an-out-of-bounds-read-vulnerability-in-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-95114 · Severity: high · CVSS 7.5 · Published 2026-10-13

libwebsockets is a lightweight WebSocket library used to build real-time communication features in web applications and IoT devices. An out-of-bounds read vulnerability in its JSON parser (LEJP) can be triggered by sending a specially crafted input that causes a denial of service, potentially disrupting services that depend on this library.

Technologies: [Warmcat Libwebsockets](https://junglewise.ai/threats/technologies/libwebsockets). Vendors: [Warmcat](https://junglewise.ai/threats/vendors/warmcat).

## Quick answers

**Is CVE-2026-95114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-95114 being exploited in the wild.

**How severe is CVE-2026-95114?** High severity, with a CVSS score of 7.5, published 13 October 2026.

**Which products and versions are affected?** Warmcat Libwebsockets before fix commit 736a4a26fce344766bc6618df87bf32193829dd0.

**Is there a fix for CVE-2026-95114?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-95114 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-95114?** Check whether you run Warmcat Libwebsockets at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The LEJP incremental parser in lib/misc/lejp.c fails to properly roll back the stack pointer (ctx->sp) when rejecting stack overflow, leaving it at position 64 (one past the valid 63-entry boundary). On the next call to lejp_parse(), the function unconditionally reads ctx->st[ctx->sp], resulting in an out-of-bounds read of ctx->st[64]. This is a remote vulnerability requiring only network access to send malicious JSON to a vulnerable application.

## Affected products

- warmcat libwebsockets before fix commit 736a4a26fce344766bc6618df87bf32193829dd0

## Timeline

- 2026-10-13: disclosed
- 2026-10-10: other: vulnerability details disclosed on GitHub

## References

- [https://gist.github.com/1820893135-pixel/34d3bc35f74eb0807e73b1df3f15af42](https://gist.github.com/1820893135-pixel/34d3bc35f74eb0807e73b1df3f15af42)
- [https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0](https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0)

## Related threats

- [warmcat libwebsockets out-of-bounds write in LECP CBOR parsing](https://junglewise.ai/threats/cve-2026-78161-warmcat-libwebsockets-out-of-bounds-write-in-lecp-cbor-parsing)
- [Warmcat libwebsockets resource consumption in SSH Protocol Handler](https://junglewise.ai/threats/cve-2026-10650-warmcat-libwebsockets-resource-consumption-in-ssh-protocol)