ZDI 2026-08-24

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

CVE-2026-19773

Machine-generated analysis · WAYSCloud LLM

Remote unauthenticated attackers can trigger an out-of-bounds write in libwebsockets' HTTP/2 HPACK path header parsing.

Context

The advisory concerns the libwebsockets library. It describes an out-of-bounds write in the HTTP/2 HPACK path header parsing that enables remote code execution without authentication. The advisory assigns a CVSS v3.1 score of 9.8 (CVE-2026-19773).

Operator considerations

Check: Verify the libwebsockets version deployed on each system.
Isolate: Consider isolating services that expose libwebsockets until a fix is available.
Log: Record HTTP/2 HPACK path header parsing failures for further analysis.

From Zero Day Initiative ↗

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19773.

Read the full advisory on ZDI →