Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
Libwebsockets: Malicious SSH Input Can Cause High CPU Usage
published 4 months ago
Summary
A security issue affects the way Libwebsockets handles SSH connections. An attacker can send malicious input to cause the server to consume excessive resources, potentially leading to performance issues. To fix this, update Libwebsockets to the latest version, applying any available patches.
What to do
- Update openeuler libwebsockets to version 4.3.0-8.oe2203sp4.
- Update openeuler libwebsockets to version 4.3.3-5.oe2403sp1.
- Update openeuler libwebsockets to version 4.3.3-5.oe2403sp3.
- Update openeuler libwebsockets to version 4.3.0-8.oe2003sp4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| openEuler:22.03-LTS-SP4 | openeuler | libwebsockets |
< 4.3.0-8.oe2203sp4 Fix: upgrade to 4.3.0-8.oe2203sp4
|
| openEuler:24.03-LTS-SP1 | openeuler | libwebsockets |
< 4.3.3-5.oe2403sp1 Fix: upgrade to 4.3.3-5.oe2403sp1
|
| openEuler:24.03-LTS-SP3 | openeuler | libwebsockets |
< 4.3.3-5.oe2403sp3 Fix: upgrade to 4.3.3-5.oe2403sp3
|
| openEuler:20.03-LTS-SP4 | openeuler | libwebsockets |
< 4.3.0-8.oe2003sp4 Fix: upgrade to 4.3.0-8.oe2003sp4
|
Original advisory text
libwebsockets security update
Libwebsockets (LWS) is a flexible, lightweight pure C library for implementing modern network protocols easily with a tiny footprint, using a nonblocking event loop.
Security Fix(es):
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.(CVE-2026-10650)
Security Fix(es):
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.(CVE-2026-10650)
References
- https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-10650 Vendor Advisory
Severity
5.3
Medium
Timeline
Published12 Jun 2026
Updated21 Aug 2026
First seen12 Jun 2026
Sources
OESA-2026-2668 · OSV
Track software like this
Free during beta