CVE-2025-11677: medium-severity vulnerability in warmcat libwebsockets
Use After Free in libwebsockets WebSocket server
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.4%
exploitation probability
0.4%top 67% of all CVEs
observed exploitation
nono source reports it
Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
warmcat · libwebsocketsRelated CVEs — warmcat libwebsockets
In the same product, most dangerous first.
CVE-2025-1866CRITICALUndefined Behavior Due to Out-of-Bounds Pointer Arithmetic in libwebsocketsEPSS 0.4%CVE-2026-10650MEDIUMwarmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumptionEPSS 0.4%CVE-2026-78161MEDIUMwarmcat libwebsockets LECP CBOR Recording lecp.c report_raw_cbor out-of-bounds writeEPSS 0.4%CVE-2025-11680MEDIUMOut-of-bounds Write in libwebsockets PNG parsingEPSS 0.4%CVE-2025-11679MEDIUMOut-of-bounds Read in libwebsockets PNG parsingEPSS 0.4%