{"id":"CVE-2025-11677","aliases":["BELL-CVE-2025-11677","DEBIAN-CVE-2025-11677","DLA-4373-1","EUVD-2025-35045","GHSA-fpc8-25p9-jfmr","OESA-2025-2611","UBUNTU-CVE-2025-11677","USN-8024-1"],"status":"published","title":"Use After Free in libwebsockets WebSocket server","description":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00405,"percentile":0.35212,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2025-10-20T13:41:10Z","modified":"2026-10-09T10:00:45Z","fixes":[{"ecosystem":"Alpaquita:23","package":"libwebsockets","fixed_in":["4.3.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libwebsockets","fixed_in":["4.3.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libwebsockets","fixed_in":["4.3.10-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libwebsockets","fixed_in":["4.3.5-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libwebsockets","fixed_in":["4.3.5-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libwebsockets","fixed_in":["3.2.1-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libwebsockets","fixed_in":["4.0.20-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libwebsockets","fixed_in":["4.3.3-1.1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.2-r1"},{"fixed":"4.3.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.5-r2"},{"fixed":"4.3.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-r0"},{"fixed":"4.3.10-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.6-3","4.1.6-3.1","4.3.2-1","4.3.2-2","4.3.2-3","4.3.2-4","4.3.3-1","4.3.3-1.1","4.3.3-1.1~exp1","4.3.5-1","4.3.5-2","4.3.5-3","4.3.5-4","4.3.5-4.1","4.3.5-5","4.3.5-6","4.3.5-7"]},{"source":"osv","ecosystem":"Debian:13","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-1+deb13u1"}]}],"versions":["4.3.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-3"}]}],"versions":["4.3.5-1","4.3.5-2"]},{"source":"osv","ecosystem":"Debian:11","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.20-2+deb11u1"}]}],"versions":["4.0.20-2"],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-7.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-7.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-7.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu0.1~esm1"}]}],"versions":["2.0.3-3build1","3.2.1-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.20-2ubuntu1.1"}]}],"versions":["4.0.20-2","4.0.20-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-1.1ubuntu0.1~esm1"}]}],"versions":["4.3.2-4","4.3.3-1","4.3.3-1.1build1","4.3.3-1.1build2","4.3.3-1.1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu0.1~esm1"}]}],"versions":["2.0.3-3build1","3.2.1-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.20-2ubuntu1.1"}]}],"versions":["4.0.20-2","4.0.20-2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-1.1ubuntu0.1~esm1"}]}],"versions":["4.3.2-4","4.3.3-1","4.3.3-1.1build1","4.3.3-1.1build2","4.3.3-1.1build3"],"bundled":2}],"products":[{"vendor":"warmcat","product":"libwebsockets"}],"references":[{"url":"https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a","tags":["patch","vendor-advisory","report"]},{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677","tags":["third-party-advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11677","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-fpc8-25p9-jfmr"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-11677","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-11677","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11678","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11677","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11677","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8024-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11678","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-11677","title":"Use After Free in libwebsockets WebSocket server","description":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.","status":"published","published":"2025-10-20T13:41:10.787Z","modified":"2025-10-24T10:54:30.961Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:32:50.872559Z"}],"euvd":[{"id":"EUVD-2025-35045","description":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.","status":"published","published":"2025-10-20T13:41:10Z","modified":"2025-10-24T10:54:30Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:49:37.862275Z"}],"ghsa":[{"id":"GHSA-fpc8-25p9-jfmr","title":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat...","description":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.","status":"published","published":"2025-10-20T15:30:25Z","modified":"2025-10-20T15:30:36Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:04:01.823376Z"}],"nvd":[{"id":"CVE-2025-11677","description":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.","status":"published","published":"2025-10-20T14:15:39.357Z","modified":"2026-10-08T22:10:00.563Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"DEBIAN-CVE-2025-11677","description":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.","status":"published","published":"2025-10-20T14:15:39.357Z","modified":"2026-10-09T10:00:45.973305093Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2025-2611","title":"libwebsockets security update","description":"Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.\r\n\r\nSecurity Fix(es):\n\nUse After Free vulnerability exists in the WebSocket server implementation in lws_handshake_server in warmcat libwebsockets. In specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, an attacker may achieve denial of service.(CVE-2025-11677)\n\nStack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.(CVE-2025-11678)","status":"published","published":"2025-10-31T11:09:44Z","modified":"2026-08-18T01:19:18.127513311Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2025-11677","description":"Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.","status":"published","published":"2025-10-20T14:15:00Z","modified":"2026-04-22T15:29:54.038687Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"BELL-CVE-2025-11677","status":"published","published":"2025-10-23T06:06:32.447771Z","modified":"2026-06-23T07:15:06.097740405Z","updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"DLA-4373-1","title":"libwebsockets - security update","status":"published","published":"2025-11-17T00:00:00Z","modified":"2025-11-17T23:17:41.716948Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-8024-1","title":"libwebsockets vulnerabilities","description":"Raffaele Bova discovered that Libwebsockets incorrectly handled memory\nwhen the upgrade header is not valid in the WebSocket server. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2025-11677)\n\nRaffaele Bova discovered that Libwebsockets did not properly check the\nsize of the destination buffer in the async-dns component. An attacker\ncould possibly use this issue to cause applications to crash, leading to a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-11678)","status":"published","published":"2026-02-11T12:58:26Z","modified":"2026-04-27T18:36:50.452678Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}