CVE-2026-95115

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a...

7.5 HighFix available

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.55%Up 0.3 points since Oct 14, 2026

What each source reports

CVE List Score used 7.5

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Record: CVE-2026-95115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2026-98806 7.5

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Record: EUVD-2026-98806
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-9f4q-6c78-chwx 7.5

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a...

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Record: GHSA-9f4q-6c78-chwx
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD 7.5

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Record: CVE-2026-95115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2026-95115 7.5

Record: BELL-CVE-2026-95115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 7.5

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Record: CVE-2026-95115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVDEBIAN-CVE-2026-95115 7.5

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Record: DEBIAN-CVE-2026-95115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4613 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4613
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4614 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4614
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4615 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4615
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4616 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4616
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-95115 7.5

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser

Record: UBUNTU-CVE-2026-95115
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`libwebsockets` Alpaquita:23	4.3.2-r1 up to 4.3.10-r2	4.3.10-r2
`libwebsockets` Alpaquita:25	4.3.5-r2 up to 4.3.10-r2	4.3.10-r2
`libwebsockets` Alpaquita:stream	4.3.1-r0 up to 4.3.10-r3	4.3.10-r3
`libwebsockets` Debian:12	All versions, plus listed versions 4.1.6-34.1.6-3.14.3.2-14.3.2-24.3.2-3 Show 12 moreShow less 4.3.2-44.3.3-14.3.3-1.14.3.3-1.1~exp14.3.5-14.3.5-24.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7	None known
`libwebsockets` Debian:13	All versions, plus listed versions 4.3.5-14.3.5-1+deb13u14.3.5-1+deb13u24.3.5-1+deb13u34.3.5-2 Show 6 moreShow less 4.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7	None known
`libwebsockets` Debian:14	All versions, plus listed versions 4.3.5-14.3.5-24.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7	None known
`libwebsockets` openEuler:24.03-LTS-SP3	before 4.3.3-9.oe2403sp3	4.3.3-9.oe2403sp3
`libwebsockets` openEuler:24.03-LTS-SP4	before 4.3.3-9.oe2403sp4	4.3.3-9.oe2403sp4
`libwebsockets` openEuler:22.03-LTS-SP4	before 4.3.0-12.oe2203sp4	4.3.0-12.oe2203sp4
`libwebsockets` openEuler:24.03-LTS-SP1	before 4.3.3-9.oe2403sp1	4.3.3-9.oe2403sp1

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`libwebsockets` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.2.2-11.6.0-31.6.0-41.6.0-51.6.1-1 Show 4 moreShow less 1.7.0-1ubuntu11.7.0-21.7.1-11.7.1-1ubuntu0.1~esm1	None known
`libwebsockets` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.0.3-32.0.3-3build12.0.3-3ubuntu0.1~esm1	None known
`libwebsockets` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 2.0.3-3build13.2.1-33.2.1-3ubuntu0.1~esm13.2.1-3ubuntu0.1~esm23.2.1-3ubuntu0.1~esm3	None known
`libwebsockets` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.0.20-24.0.20-2ubuntu14.0.20-2ubuntu1.14.0.20-2ubuntu1.1+esm14.0.20-2ubuntu1.1+esm2	None known
`libwebsockets` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 4.3.2-44.3.3-14.3.3-1.1build14.3.3-1.1build24.3.3-1.1build34.3.3-1.1ubuntu0.1~esm14.3.3-1.1ubuntu0.1~esm24.3.3-1.1ubuntu0.1~esm3	None known
`libwebsockets` Ubuntu:26.10	All versions, plus listed versions 4.3.5-3ubuntu14.3.5-4.14.3.5-54.3.5-5ubuntu14.3.5-5ubuntu24.3.5-7ubuntu1	None known
`libwebsockets` Ubuntu:Pro:26.04:LTS	All versions, plus listed versions 4.3.5-14.3.5-34.3.5-3ubuntu14.3.5-3ubuntu1.14.3.5-3ubuntu1.2+esm1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-95115 is a high vulnerability (CVSS 7.5) in libwebsockets, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 45th percentile. Fixed in libwebsockets 4.3.10-r2.

References

Show 10 moreShow less