Out-of-Bounds Read in libwebsockets LEJP Parser

Executive Summary

CVE-2026-95114 is an out-of-bounds read vulnerability in the libwebsockets library affecting the LEJP incremental parser in lib/misc/lejp.c. The issue occurs when a crafted input causes a stack overflow, leaving the stack pointer (ctx->sp) at an invalid position (64 instead of 0-63). Subsequent calls to the parser then read outside the valid stack bounds, causing undefined behavior and potential denial of service.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for crashes or undefined behavior in applications using libwebsockets, particularly during incremental JSON parsing. Monitor logs for SIGILL crashes in sanitizer builds or segmentation faults in release builds. Test with crafted inputs that trigger stack overflows in the LEJP parser.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause crashes in sanitizer builds (e.g., SIGILL) and undefined behavior in release builds. It may lead to denial of service if exploited during a two-phase feed where input is split into sequential parts. Systems using libwebsockets for JSON parsing could experience instability or unexpected termination.

Useful 0 Not Useful 0

Mitigation Strategies

Update libwebsockets to a patched version that includes commits c404a20 and 736a4a2. If updating is not immediately possible, avoid processing split-phase JSON inputs that could trigger the vulnerability. Disable affected services if they handle untrusted JSON data.

Useful 0 Not Useful 0