Back Linuxsecurity Debian 11: Libwebsockets Critical DoS and Buffer Overflow DLA-4373
CVE-2025-11677 Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service. CVE-2025-11678 Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching ID containing a label longer than the maximum. For Debian 11 bullseye, these problems have been fixed in version 4.0.20-2+deb11u1. We recommend that you upgrade your libwebsockets packages. For the detailed security status of libwebsockets please refer to its security tracker page at:
CVE-2025-11677 Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service. CVE-2025-11678 Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching ID containing a label longer than the maximum. For Debian 11 bullseye, these problems have been fixed in version 4.0.20-2+deb11u1. We recommend that you upgrade your libwebsockets packages. For the detailed security status of libwebsockets please refer to its security tracker page at:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
