Source: libwebsockets X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for libwebsockets. CVE-2026-95114[0]: | libwebsockets contains an out-of-bounds read vulnerability in the | LEJP incremental parser in lib/misc/lejp.c. This allows a remote | attacker to cause a denial of service https://github.com/warmcat/libwebsockets/issues/3664 https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a CVE-2026-95115[1]: | Buffer Overflow vulnerability in libwebsockets main 106d542c allows | a remote attacker to cause a denial of service via the LEJP JSON | parser https://github.com/warmcat/libwebsockets/issues/3663 https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-95114 https://www.cve.org/CVERecord?id=CVE-2026-95114 [1] https://security-tracker.debian.org/tracker/CVE-2026-95115 https://www.cve.org/CVERecord?id=CVE-2026-95115 Please adjust the affected versions in the BTS as needed.
