CVE-2026-95114

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib...

7.5 HighFix available

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.52%Unchanged since Oct 14, 2026

What each source reports

CVE List Score used 7.5

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Record: CVE-2026-95114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

EUVDEUVD-2026-98808 7.5

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Record: EUVD-2026-98808
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cf7h-w57m-f768 7.5

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib...

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Record: GHSA-cf7h-w57m-f768
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

NVD 7.5

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Record: CVE-2026-95114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-125
Updated: 2026-11-02

OSVBELL-CVE-2026-95114 7.5

Record: BELL-CVE-2026-95114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

OSV 7.5

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Record: CVE-2026-95114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVDEBIAN-CVE-2026-95114 7.5

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Record: DEBIAN-CVE-2026-95114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4613 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4613
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4614 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4614
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4615 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4615
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2026-4616 7.5

libwebsockets security update

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.

Security Fix(es):

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service(CVE-2026-95114)

Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser(CVE-2026-95115)

Record: OESA-2026-4616
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-95114 7.5

libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service

Record: UBUNTU-CVE-2026-95114
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`libwebsockets` Alpaquita:23	4.3.2-r1 up to 4.3.10-r2	4.3.10-r2
`libwebsockets` Alpaquita:25	4.3.5-r2 up to 4.3.10-r2	4.3.10-r2
`libwebsockets` Alpaquita:stream	4.3.1-r0 up to 4.3.10-r3	4.3.10-r3
`libwebsockets` Debian:12	All versions, plus listed versions 4.1.6-34.1.6-3.14.3.2-14.3.2-24.3.2-3 Show 12 moreShow less 4.3.2-44.3.3-14.3.3-1.14.3.3-1.1~exp14.3.5-14.3.5-24.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7	None known
`libwebsockets` Debian:13	All versions, plus listed versions 4.3.5-14.3.5-1+deb13u14.3.5-1+deb13u24.3.5-1+deb13u34.3.5-2 Show 6 moreShow less 4.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7	None known
`libwebsockets` Debian:14	All versions, plus listed versions 4.3.5-14.3.5-24.3.5-34.3.5-44.3.5-4.14.3.5-54.3.5-64.3.5-7	None known
`libwebsockets` openEuler:24.03-LTS-SP3	before 4.3.3-9.oe2403sp3	4.3.3-9.oe2403sp3
`libwebsockets` openEuler:24.03-LTS-SP4	before 4.3.3-9.oe2403sp4	4.3.3-9.oe2403sp4
`libwebsockets` openEuler:22.03-LTS-SP4	before 4.3.0-12.oe2203sp4	4.3.0-12.oe2203sp4
`libwebsockets` openEuler:24.03-LTS-SP1	before 4.3.3-9.oe2403sp1	4.3.3-9.oe2403sp1

Show 7 moreShow less

Affected packages
Package	Affected	Fixed
`libwebsockets` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.2.2-11.6.0-31.6.0-41.6.0-51.6.1-1 Show 4 moreShow less 1.7.0-1ubuntu11.7.0-21.7.1-11.7.1-1ubuntu0.1~esm1	None known
`libwebsockets` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.0.3-32.0.3-3build12.0.3-3ubuntu0.1~esm1	None known
`libwebsockets` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 2.0.3-3build13.2.1-33.2.1-3ubuntu0.1~esm13.2.1-3ubuntu0.1~esm23.2.1-3ubuntu0.1~esm3	None known
`libwebsockets` Ubuntu:Pro:22.04:LTS	All versions, plus listed versions 4.0.20-24.0.20-2ubuntu14.0.20-2ubuntu1.14.0.20-2ubuntu1.1+esm14.0.20-2ubuntu1.1+esm2	None known
`libwebsockets` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 4.3.2-44.3.3-14.3.3-1.1build14.3.3-1.1build24.3.3-1.1build34.3.3-1.1ubuntu0.1~esm14.3.3-1.1ubuntu0.1~esm24.3.3-1.1ubuntu0.1~esm3	None known
`libwebsockets` Ubuntu:26.10	All versions, plus listed versions 4.3.5-3ubuntu14.3.5-4.14.3.5-54.3.5-5ubuntu14.3.5-5ubuntu24.3.5-7ubuntu1	None known
`libwebsockets` Ubuntu:Pro:26.04:LTS	All versions, plus listed versions 4.3.5-14.3.5-34.3.5-3ubuntu14.3.5-3ubuntu1.14.3.5-3ubuntu1.2+esm1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-95114 is a high vulnerability (CVSS 7.5) in libwebsockets, published October 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in libwebsockets 4.3.10-r2.

References

Show 10 moreShow less