Your message dated Mon, 28 Sep 2026 05:35:47 +0000
with message-id <[email protected]>
and subject line Bug#1149178: fixed in libwebsockets 4.3.5-7
has caused the Debian Bug report #1149178,
regarding libwebsockets: CVE-2026-19773
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1149178: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149178
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libwebsockets
X-Debbugs-CC: [email protected]
Severity: grave
Tags: security
Hi,
The following vulnerability was published for libwebsockets.
CVE-2026-19773[0]:
| libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write
| Remote Code Execution Vulnerability. This vulnerability allows
| remote attackers to execute arbitrary code on affected installations
| of libwebsockets. Authentication is not required to exploit this
| vulnerability. The specific flaw exists within the parsing of
| HTTP/2 HPACK path header. The issue results from the lack of proper
| validation of user-supplied data, which can result in a write past
| the end of an allocated buffer. An attacker can leverage this
| vulnerability to execute code in the context of the current process.
| Was ZDI-CAN-31036.
https://www.zerodayinitiative.com/advisories/ZDI-26-590/
Fixed by:
https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b
(v5.0.0)
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-19773
https://www.cve.org/CVERecord?id=CVE-2026-19773
Please adjust the affected versions in the BTS as needed.
--- End Message ---
--- Begin Message ---
Source: libwebsockets
Source-Version: 4.3.5-7
Done: Laszlo Boszormenyi (GCS) <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libwebsockets, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Laszlo Boszormenyi (GCS) <[email protected]> (supplier of updated libwebsockets
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 28 Sep 2026 07:19:09 +0200
Source: libwebsockets
Architecture: source
Version: 4.3.5-7
Distribution: unstable
Urgency: high
Maintainer: Laszlo Boszormenyi (GCS) <[email protected]>
Changed-By: Laszlo Boszormenyi (GCS) <[email protected]>
Closes: 1149178
Changes:
libwebsockets (4.3.5-7) unstable; urgency=high
.
* Backport upstream security fix for CVE-2026-19773: HTTP/2 HPACK Path
Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
(closes: #1149178).
Checksums-Sha1:
a81461ef608830484958e54a812c140a270ad404 2547 libwebsockets_4.3.5-7.dsc
551e268d73a6558102926828f25ff544ff307d70 25220
libwebsockets_4.3.5-7.debian.tar.xz
Checksums-Sha256:
36da3b323d9412e333740dbb5228452917d3348a94a72f9e966db21931b2c72e 2547
libwebsockets_4.3.5-7.dsc
2dc9a4dc17f6db275dab206b0c482b3f5e4d332ca092e94e974341af07fb5dbf 25220
libwebsockets_4.3.5-7.debian.tar.xz
Files:
350aed39353d538facc3e2dca6f210bd 2547 libs optional libwebsockets_4.3.5-7.dsc
07c38204388999f84d576157e2ce67e5 25220 libs optional
libwebsockets_4.3.5-7.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEfYh9yLp7u6e4NeO63OMQ54ZMyL8FAmq5+gMACgkQ3OMQ54ZM
yL/W5w//SJNSt4ZusIDDUWmuPgbrN2ema+tesGUxJWgaZkHEYIfYSArSmj+k1ESv
P31LjkQ4OSfD2kXWis2ZkYmJu0l0Lj3MMyPnixFz8mtdSSFAPlCLmDasSOzekHa9
VzEImmWUkqw1OeOmyggh0Hj8w6+R8/RzO0kwpIlvvAZm8TOax0yoxv+VKdYtZj7D
T8am8rH7JMh5J9fmTeb6JWMn2gzr7YzNdMEJ3r3AywkN+Pgx505fZ/IwAw5LS2fC
CGc8ccHDUeht0yKBBEc9hjbB6LfKbaUT9sixk9iXPfgq8492c2rLWyrZ5wX4DClJ
oWr7SwETMf8upLPtqhqAz7MDliZjSnwskZOQEDJaLxTDrXuUjtMYP1A/ywIyv/ON
z16lMCVMgsOhAsO/1pOT84fmzlfaDxJ8N+qrqUZtqs92eNQgEM55E9QYGfJc0KjD
UwHPr/AfOHWvmvnJp86I+FzPsC8GetRfqyiYJeBnf3Y0QsT67wZAX3I3kdM5Ux7N
ZGyvzP/1IfD3pjy/xn+0mBhYw/APZlgy7iEkPE2+AZHmyyUpp09Ejs+ffmvGDESl
2GS4CXQLCtHhFS3oEdGUnaCtvi0ms9Uxt+qiub9mMcncKpu58JDP3/TFY4glQ1NJ
iu1xKvWMSMneqhguUBGjoYc+NV5Nc2eMcy5XcCEGOExL51y+xnk=
=tx4M
-----END PGP SIGNATURE-----
pgpo2yEEk7Eno.pgp
Description: PGP signature
--- End Message ---
