# CVE-2026-10650: libwebsockets: A flaw has been found in warmcat libwebsockets up to 4.5.8

CVE-2026-10650 is fixed in 12 products on 1 platform, first by libwebsockets-test-server 3.2.1-3ubuntu0.1~esm2, released June 2, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-10650
- Priority: Routine
- CVSS: n/a (Medium)
- EPSS: 0.0043
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jun 2, 2026

## Description

A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | libwebsockets Debian 13.5 (trixie) | 4.3.5-1+deb13u2 | [DEBIAN-CVE-2026-10650](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10650.md) | Jun 24, 2026 |
| Linux | libwebsockets Debian 14 | 4.3.5-5 | [DEBIAN-CVE-2026-10650](https://patchblox.com/security/data/fix/linux/debian-cve-2026-10650.md) | Jun 24, 2026 |
| Linux | libwebsockets Fedora 43 | 4.5.8-2.fc43 | [FEDORA-2026-59FDEF3E5F](https://patchblox.com/security/data/fix/linux/fedora-2026-59fdef3e5f.md) | Jul 18, 2026 |
| Linux | libwebsockets-debuginfo Fedora 43 | 4.5.8-2.fc43 | [FEDORA-2026-59FDEF3E5F](https://patchblox.com/security/data/fix/linux/fedora-2026-59fdef3e5f.md) | Jul 18, 2026 |
| Linux | libwebsockets-debugsource Fedora 43 | 4.5.8-2.fc43 | [FEDORA-2026-59FDEF3E5F](https://patchblox.com/security/data/fix/linux/fedora-2026-59fdef3e5f.md) | Jul 18, 2026 |
| Linux | libwebsockets-devel Fedora 43 | 4.5.8-2.fc43 | [FEDORA-2026-59FDEF3E5F](https://patchblox.com/security/data/fix/linux/fedora-2026-59fdef3e5f.md) | Jul 18, 2026 |
| Linux | libwebsockets-evlib-ev Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | [libwebsockets-evlib-ev 4.3.3-1.1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwebsockets-evlib-ev-4.3.3-1.1ubuntu0.1-esm2.md) | Aug 23, 2026 |
| Linux | libwebsockets-evlib-ev Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | [libwebsockets-evlib-ev 4.3.5-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libwebsockets-evlib-ev-4.3.5-3ubuntu1.1.md) | Aug 23, 2026 |
| Linux | libwebsockets-evlib-glib Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | [libwebsockets-evlib-glib 4.3.3-1.1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwebsockets-evlib-glib-4.3.3-1.1ubuntu0.1-esm2.md) | Aug 23, 2026 |
| Linux | libwebsockets-evlib-glib Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | [libwebsockets-evlib-glib 4.3.5-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libwebsockets-evlib-glib-4.3.5-3ubuntu1.1.md) | Aug 23, 2026 |
| Linux | libwebsockets-evlib-uv Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | [libwebsockets-evlib-uv 4.3.3-1.1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwebsockets-evlib-uv-4.3.3-1.1ubuntu0.1-esm2.md) | Aug 23, 2026 |
| Linux | libwebsockets-evlib-uv Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | [libwebsockets-evlib-uv 4.3.5-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libwebsockets-evlib-uv-4.3.5-3ubuntu1.1.md) | Aug 23, 2026 |
| Linux | libwebsockets-test-server Ubuntu 20.04 LTS (focal) | 3.2.1-3ubuntu0.1~esm2 | [libwebsockets-test-server 3.2.1-3ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebsockets-test-server-3.2.1-3ubuntu0.1-esm2.md) | Jun 2, 2026 |
| Linux | libwebsockets-test-server Ubuntu 22.04.1 LTS (jammy) | 4.0.20-2ubuntu1.1+esm1 | [libwebsockets-test-server 4.0.20-2ubuntu1.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebsockets-test-server-4.0.20-2ubuntu1.1-esm1.md) | Jun 2, 2026 |
| Linux | libwebsockets-test-server Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | [libwebsockets-test-server 4.3.3-1.1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwebsockets-test-server-4.3.3-1.1ubuntu0.1-esm2.md) | Aug 23, 2026 |
| Linux | libwebsockets-test-server Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | [libwebsockets-test-server 4.3.5-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libwebsockets-test-server-4.3.5-3ubuntu1.1.md) | Aug 23, 2026 |
| Linux | libwebsockets-test-server-common Ubuntu 20.04 LTS (focal) | 3.2.1-3ubuntu0.1~esm2 | [libwebsockets-test-server-common 3.2.1-3ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebsockets-test-server-common-3.2.1-3ubuntu0.1-esm2.md) | Jun 2, 2026 |
| Linux | libwebsockets-test-server-common Ubuntu 22.04.1 LTS (jammy) | 4.0.20-2ubuntu1.1+esm1 | [libwebsockets-test-server-common 4.0.20-2ubuntu1.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebsockets-test-server-common-4.0.20-2ubuntu1.1-esm1.md) | Jun 2, 2026 |
| Linux | libwebsockets-test-server-common Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | [libwebsockets-test-server-common 4.3.3-1.1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwebsockets-test-server-common-4.3.3-1.1ubuntu0.1-esm2.md) | Aug 23, 2026 |
| Linux | libwebsockets-test-server-common Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | [libwebsockets-test-server-common 4.3.5-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libwebsockets-test-server-common-4.3.5-3ubuntu1.1.md) | Aug 23, 2026 |
| Linux | libwebsockets15 Ubuntu 20.04 LTS (focal) | 3.2.1-3ubuntu0.1~esm2 | [libwebsockets15 3.2.1-3ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libwebsockets15-3.2.1-3ubuntu0.1-esm2.md) | Jun 2, 2026 |
| Linux | libwebsockets16 Ubuntu 22.04.1 LTS (jammy) | 4.0.20-2ubuntu1.1+esm1 | [libwebsockets16 4.0.20-2ubuntu1.1+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libwebsockets16-4.0.20-2ubuntu1.1-esm1.md) | Jun 2, 2026 |
| Linux | libwebsockets19t64 Ubuntu 24.04.5 LTS (noble) | 4.3.3-1.1ubuntu0.1~esm2 | [libwebsockets19t64 4.3.3-1.1ubuntu0.1~esm2](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libwebsockets19t64-4.3.3-1.1ubuntu0.1-esm2.md) | Aug 23, 2026 |
| Linux | libwebsockets19t64 Ubuntu 26.04.1 LTS (resolute) | 4.3.5-3ubuntu1.1 | [libwebsockets19t64 4.3.5-3ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-resolute-libwebsockets19t64-4.3.5-3ubuntu1.1.md) | Aug 23, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.