CVE-2026-10650

EUVD-2026-34034
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 35.61%
Debian logo
Debian Releases
Debian Product
Codename
libwebsockets
bookworm
no-dsa
bullseye
postponed
forky
4.3.5-7
fixed
sid
4.3.5-7
fixed
trixie
4.3.5-1+deb13u2
fixed
trixie (security)
4.3.5-1+deb13u3
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
libwebsockets
bionic
not-affected
focal
Fixed 3.2.1-3ubuntu0.1~esm2
released
jammy
Fixed 4.0.20-2ubuntu1.1+esm1
released
noble
Fixed 4.3.3-1.1ubuntu0.1~esm2
released
questing
ignored
resolute
Fixed 4.3.5-3ubuntu1.1
released
xenial
not-affected
Common Weakness Enumeration
References
https://github.com/biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded-alloc/poc_sshd_unbounded_alloc.py
https://github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded-alloc
https://github.com/warmcat/libwebsockets/
https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498
https://vuldb.com/cve/CVE-2026-10650
https://vuldb.com/submit/830261
https://vuldb.com/vuln/367955
https://vuldb.com/vuln/367955/cti