Affected: Alpaquita:23: libwebsockets, Alpaquita:25: libwebsockets, Alpaquita:stream: libwebsockets

Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.

Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.

Affected: openEuler:22.03-LTS-SP4: libwebsockets, openEuler:24.03-LTS: libwebsockets, openEuler:24.03-LTS-SP1: libwebsockets, openEuler:24.03-LTS-SP2: libwebsockets, openEuler:20.03-LTS-SP4: libwebsockets, openEuler:22.03-LTS-SP3: libwebsockets

Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop. Security Fix(es):

Use After Free vulnerability exists in the WebSocket server implementation in lws_handshake_server in warmcat libwebsockets. In specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, an attacker may achieve denial of service.(CVE-2025-11677)

Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.(CVE-2025-11678)

Affected: Ubuntu:Pro:20.04:LTS: libwebsockets, Ubuntu:22.04:LTS: libwebsockets, Ubuntu:Pro:24.04:LTS: libwebsockets, Ubuntu:25.10: libwebsockets

Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.