libwebsockets: A flaw has been found in warmcat libwebsockets up to 4.5.8
CVE-2026-10650 is fixed in 12 products on 1 platform, first by libwebsockets-test-server 3.2.1-3ubuntu0.1~esm2, released June 2, 2026. It is not reported as exploited. Patch Radar priority: Routine.
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| libwebsockets · Debian 13.5 (trixie) | 4.3.5-1+deb13u2 | DEBIAN-CVE-2026-10650 | Jun 24, 2026 |
| libwebsockets · Debian 14 | 4.3.5-5 | DEBIAN-CVE-2026-10650 | Jun 24, 2026 |
| libwebsockets · Fedora 43 | 4.5.8-2.fc43 | FEDORA-2026-59FDEF3E5F | Jul 18, 2026 |
| libwebsockets-debuginfo · Fedora 43 | 4.5.8-2.fc43 | FEDORA-2026-59FDEF3E5F | Jul 18, 2026 |
| libwebsockets-debugsource · Fedora 43 | 4.5.8-2.fc43 | FEDORA-2026-59FDEF3E5F | Jul 18, 2026 |
| libwebsockets-devel · Fedora 43 | 4.5.8-2.fc43 | FEDORA-2026-59FDEF3E5F | Jul 18, 2026 |
| libwebsockets-evlib-ev · Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | libwebsockets-evlib-ev 4.3.3-1.1ubuntu0.1~esm2 | Aug 23, 2026 |
| libwebsockets-evlib-ev · Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | libwebsockets-evlib-ev 4.3.5-3ubuntu1.1 | Aug 23, 2026 |
| libwebsockets-evlib-glib · Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | libwebsockets-evlib-glib 4.3.3-1.1ubuntu0.1~esm2 | Aug 23, 2026 |
| libwebsockets-evlib-glib · Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | libwebsockets-evlib-glib 4.3.5-3ubuntu1.1 | Aug 23, 2026 |
| libwebsockets-evlib-uv · Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | libwebsockets-evlib-uv 4.3.3-1.1ubuntu0.1~esm2 | Aug 23, 2026 |
| libwebsockets-evlib-uv · Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | libwebsockets-evlib-uv 4.3.5-3ubuntu1.1 | Aug 23, 2026 |
| libwebsockets-test-server · Ubuntu 20.04 LTS (focal) | 3.2.1-3ubuntu0.1~esm2 | libwebsockets-test-server 3.2.1-3ubuntu0.1~esm2 | Jun 2, 2026 |
| libwebsockets-test-server · Ubuntu 22.04.1 LTS (jammy) | 4.0.20-2ubuntu1.1+esm1 | libwebsockets-test-server 4.0.20-2ubuntu1.1+esm1 | Jun 2, 2026 |
| libwebsockets-test-server · Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | libwebsockets-test-server 4.3.3-1.1ubuntu0.1~esm2 | Aug 23, 2026 |
| libwebsockets-test-server · Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | libwebsockets-test-server 4.3.5-3ubuntu1.1 | Aug 23, 2026 |
| libwebsockets-test-server-common · Ubuntu 20.04 LTS (focal) | 3.2.1-3ubuntu0.1~esm2 | libwebsockets-test-server-common 3.2.1-3ubuntu0.1~esm2 | Jun 2, 2026 |
| libwebsockets-test-server-common · Ubuntu 22.04.1 LTS (jammy) | 4.0.20-2ubuntu1.1+esm1 | libwebsockets-test-server-common 4.0.20-2ubuntu1.1+esm1 | Jun 2, 2026 |
| libwebsockets-test-server-common · Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | libwebsockets-test-server-common 4.3.3-1.1ubuntu0.1~esm2 | Aug 23, 2026 |
| libwebsockets-test-server-common · Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | libwebsockets-test-server-common 4.3.5-3ubuntu1.1 | Aug 23, 2026 |
| libwebsockets15 · Ubuntu 20.04 LTS (focal) | 3.2.1-3ubuntu0.1~esm2 | libwebsockets15 3.2.1-3ubuntu0.1~esm2 | Jun 2, 2026 |
| libwebsockets16 · Ubuntu 22.04.1 LTS (jammy) | 4.0.20-2ubuntu1.1+esm1 | libwebsockets16 4.0.20-2ubuntu1.1+esm1 | Jun 2, 2026 |
| libwebsockets19t64 · Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | libwebsockets19t64 4.3.3-1.1ubuntu0.1~esm2 | Aug 23, 2026 |
| libwebsockets19t64 · Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | libwebsockets19t64 4.3.5-3ubuntu1.1 | Aug 23, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.