CVE-2026-19773

Received Received - Intake

HTTP/2 HPACK Path Header Parsing Out-of-Bounds Write in libwebsockets

Publication date: 2026-09-15

Last updated on: 2026-09-16

Assigner: Zero Day Initiative

Description

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-16

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-19773

EUVD

EUVD-2026-79130

Affected Vendors & Products

Vendor	Product	Version / Range
libwebsockets	libwebsockets	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a remote code execution vulnerability in libwebsockets where attackers can execute arbitrary code without authentication. The flaw occurs during HTTP/2 HPACK path header parsing due to improper validation of user-supplied data, leading to an out-of-bounds write in memory.

Detection Guidance

To detect this vulnerability, check if your system is running a vulnerable version of libwebsockets. Inspect the library version and compare it against the patched commit 824151862f37bc72f46d9a3e01d5b9408d313a0b. Commands like 'lws_version' or checking package managers (e.g., 'apt list --installed | grep libwebsockets') may help. Monitor network traffic for HTTP/2 requests targeting affected systems.

Impact Analysis

An attacker could exploit this to run malicious code on your system, potentially taking control of affected applications or servers. Since no authentication is required, any exposed libwebsockets service is at risk of compromise.

Compliance Impact

This vulnerability could lead to unauthorized code execution on systems processing sensitive data, potentially violating GDPR's integrity and confidentiality requirements or HIPAA's security rules for protected health information. The lack of authentication needed to exploit it increases the risk of data breaches.

Mitigation Strategies

Immediately update libwebsockets to the patched version referenced in commit 824151862f37bc72f46d9a3e01d5b9408d313a0b. If patching is not possible, disable HTTP/2 support or restrict access to the affected service until an update is applied. Consider isolating vulnerable systems from critical networks.

Hi! I’m here to help you understand CVE-2026-19773. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70