Resource exhaustion in Warmcat Libwebsockets
CVE-2026-10650
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.004 (34.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 35th percentile — 34.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Warmcat Libwebsockets — versions 4.5.0, 4.5.1, 4.5.2
Weakness classification (CWE)
References
- vuldb.com/vuln/367955 (technical-description, vdb-entry)
- vuldb.com/vuln/367955/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-10650 (third-party-advisory)
- vuldb.com/submit/830261 (third-party-advisory)
- github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded-alloc (exploit)
- github.com/biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded-alloc/p… (exploit)
- github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 (patch)
- github.com/warmcat/libwebsockets/ (product)
Frequently asked questions
- What is CVE-2026-10650?
- CVE-2026-10650 is a medium-severity vulnerability in Warmcat Libwebsockets, classified under Uncontrolled Resource Consumption. CVSS score: 5.3/10. Published 2026-06-02.
- How severe is CVE-2026-10650?
- Medium severity. CVSS v3 base score is 5.3 out of 10.