libwebsockets HTTP/2 HPACK Parsing Flaw Enables Remote Code Execution
A critical vulnerability in libwebsockets' HTTP/2 HPACK header parsing allows unauthenticated attackers to achieve remote code execution with a CVSS score of 9.8.
A critical vulnerability has been identified in the libwebsockets library, specifically within its handling of HTTP/2 HPACK path headers. This flaw, designated ZDI-26-590 and assigned CVE-2026-19773, permits remote attackers to execute arbitrary code on affected systems without requiring any form of authentication.
The vulnerability stems from an out-of-bounds write condition that occurs during the parsing of HPACK encoded headers. The issue arises due to insufficient validation of user-supplied data, which can lead to data being written beyond the boundaries of an allocated buffer. Successful exploitation allows an attacker to overwrite memory in a way that facilitates code execution within the context of the running process.
With a CVSS score of 9.8, this vulnerability is classified as critical, underscoring the significant risk it poses to systems utilizing libwebsockets. The ability for unauthenticated attackers to gain remote code execution means that any internet-facing service or application relying on this library could be a potential target.
Libwebsockets, a popular C networking library, is widely used in various applications and embedded systems for handling WebSocket and HTTP traffic. Its efficient implementation makes it a common choice for developers, but this widespread adoption also amplifies the potential impact of such a critical vulnerability.
The Zero Day Initiative (ZDI) reported that the vulnerability was disclosed on August 24, 2026, following its initial report to the vendor on July 3, 2026. This coordinated disclosure timeline allowed for a period of remediation before public awareness.
Fortunately, the libwebsockets project has already released an update to address this critical flaw. Developers are strongly advised to update their installations of libwebsockets to the patched version. The specific commit addressing the vulnerability can be found on the project's GitHub repository: https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b.
This vulnerability highlights the ongoing challenges in securing complex networking libraries. Proper input validation and robust memory management are crucial to prevent such critical flaws, especially in protocols like HTTP/2 that involve intricate header compression mechanisms like HPACK.