{"id":"CVE-2025-11678","aliases":["BELL-CVE-2025-11678","DEBIAN-CVE-2025-11678","DLA-4373-1","EUVD-2025-35057","GHSA-2g39-f45w-2fcm","OESA-2025-2611","RHSA-2025:22969","UBUNTU-CVE-2025-11678","USN-8024-1"],"status":"published","title":"Stack-based Buffer Overflow in libwebsockets DNS response parsing","description":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.","severity":{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00285,"percentile":0.21327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-121"],"published":"2025-10-20T13:51:17Z","modified":"2026-10-09T10:00:10Z","fixes":[{"ecosystem":"Alpaquita:23","package":"libwebsockets","fixed_in":["4.3.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"libwebsockets","fixed_in":["4.3.10-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"libwebsockets","fixed_in":["4.3.10-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libwebsockets","fixed_in":["4.3.5-1+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libwebsockets","fixed_in":["4.3.5-3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets","fixed_in":["0:4.3.0-2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets-debuginfo","fixed_in":["0:4.3.0-2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets-debugsource","fixed_in":["0:4.3.0-2.el9ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets-devel-debuginfo","fixed_in":["0:4.3.0-2.el9ost"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"libwebsockets","fixed_in":["4.0.20-2ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libwebsockets","fixed_in":["4.3.3-1.1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpaquita:23","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.2-r1"},{"fixed":"4.3.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.5-r2"},{"fixed":"4.3.10-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-r0"},{"fixed":"4.3.10-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.6-3","4.1.6-3.1","4.3.2-1","4.3.2-2","4.3.2-3","4.3.2-4","4.3.3-1","4.3.3-1.1","4.3.3-1.1~exp1","4.3.5-1","4.3.5-2","4.3.5-3","4.3.5-4","4.3.5-4.1","4.3.5-5","4.3.5-6","4.3.5-7"]},{"source":"osv","ecosystem":"Debian:13","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-1+deb13u1"}]}],"versions":["4.3.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.5-3"}]}],"versions":["4.3.5-1","4.3.5-2"]},{"source":"osv","ecosystem":"Debian:11","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.20-2+deb11u1"}]}],"versions":["4.0.20-2"],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-7.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-4.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-4.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-7.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.0-7.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.el9ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:17.1::el9","package":"libwebsockets-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.0-2.el9ost"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.20-2ubuntu1.1"}]}],"versions":["4.0.20-2","4.0.20-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-1.1ubuntu0.1~esm1"}]}],"versions":["4.3.2-4","4.3.3-1","4.3.3-1.1build1","4.3.3-1.1build2","4.3.3-1.1build3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3.5-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.1-3ubuntu0.1~esm1"}]}],"versions":["2.0.3-3build1","3.2.1-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.20-2ubuntu1.1"}]}],"versions":["4.0.20-2","4.0.20-2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"libwebsockets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-1.1ubuntu0.1~esm1"}]}],"versions":["4.3.2-4","4.3.3-1","4.3.3-1.1build1","4.3.3-1.1build2","4.3.3-1.1build3"],"bundled":2}],"products":[{"vendor":"warmcat","product":"libwebsocket"}],"references":[{"url":"https://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a","tags":["patch","vendor-advisory","article","report"]},{"url":"https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11678","tags":["third-party-advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11678","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2g39-f45w-2fcm"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-11678","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-11678","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2611","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11677","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:22969","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2405139","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_22969.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-11678","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-11678","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2025-11678","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8024-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-11677","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-11678","title":"Stack-based Buffer Overflow in libwebsockets DNS response parsing","description":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.","status":"published","published":"2025-10-20T13:51:17.328Z","modified":"2025-10-20T14:00:37.72Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:51.199669Z"}],"euvd":[{"id":"EUVD-2025-35057","description":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.","status":"published","published":"2025-10-20T13:51:17Z","modified":"2025-10-20T14:00:37Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T20:31:29.921127Z"}],"ghsa":[{"id":"GHSA-2g39-f45w-2fcm","title":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the...","description":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.","status":"published","published":"2025-10-20T15:30:25Z","modified":"2025-10-20T15:30:37Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T15:04:01.823376Z"}],"nvd":[{"id":"CVE-2025-11678","description":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.","status":"published","published":"2025-10-20T14:15:40.137Z","modified":"2026-10-08T22:10:00.563Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"DEBIAN-CVE-2025-11678","description":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.","status":"published","published":"2025-10-20T14:15:40.137Z","modified":"2026-10-09T10:00:10.721957863Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"OESA-2025-2611","title":"libwebsockets security update","description":"Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.\r\n\r\nSecurity Fix(es):\n\nUse After Free vulnerability exists in the WebSocket server implementation in lws_handshake_server in warmcat libwebsockets. In specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, an attacker may achieve denial of service.(CVE-2025-11677)\n\nStack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.(CVE-2025-11678)","status":"published","published":"2025-10-31T11:09:44Z","modified":"2026-08-18T01:19:18.127513311Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"RHSA-2025:22969","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (libwebsockets) security update","status":"published","published":"2025-12-10T10:07:06Z","modified":"2026-03-18T11:39:28.286221Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:16.589982Z"},{"id":"UBUNTU-CVE-2025-11678","description":"Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.","status":"published","published":"2025-10-20T14:15:00Z","modified":"2026-04-22T15:29:59.956328Z","cvss":[{"version":"4.0","score":7.5,"vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"BELL-CVE-2025-11678","status":"published","published":"2025-10-23T06:06:32.512491Z","modified":"2026-06-23T07:15:06.153536415Z","updated_at":"2026-11-02T15:28:21.227396Z"},{"id":"DLA-4373-1","title":"libwebsockets - security update","status":"published","published":"2025-11-17T00:00:00Z","modified":"2025-11-17T23:17:41.716948Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"USN-8024-1","title":"libwebsockets vulnerabilities","description":"Raffaele Bova discovered that Libwebsockets incorrectly handled memory\nwhen the upgrade header is not valid in the WebSocket server. An\nattacker could possibly use this issue to cause a denial of service.\n(CVE-2025-11677)\n\nRaffaele Bova discovered that Libwebsockets did not properly check the\nsize of the destination buffer in the async-dns component. An attacker\ncould possibly use this issue to cause applications to crash, leading to a\ndenial of service, or possibly execute arbitrary code. This issue only\naffected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-11678)","status":"published","published":"2026-02-11T12:58:26Z","modified":"2026-04-27T18:36:50.452678Z","updated_at":"2026-11-02T16:58:22.951676Z"}]}}