Medium 5.3Published Jun 2, 2026

CVE-2026-10650warmcat libwebsockets SSH Protocol sshd.c lws_ssh_parse_plaintext resource consumption

Updated under an hour ago (Oct 28, 2026, 3:40 AM ET)

Does this affect you?

It affects warmcat libwebsockets. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for warmcat libwebsockets

Exploited in the last 30 days

A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.

CVSS: 5.3 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
Weakness (CWE): CWE-400, CWE-404
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: VulDB
NVD analysis: Deferred
Record last updated: Jun 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

warmcat libwebsockets warmcat:libwebsockets	4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; 4.5.6; 4.5.7; and 1 more ranges	CNA record

References

References

https://vuldb.com/vuln/367955	vdb-entry, technical-description
https://vuldb.com/vuln/367955/cti	signature, permissions-required
https://vuldb.com/cve/CVE-2026-10650	third-party-advisory
https://vuldb.com/submit/830261	third-party-advisory
https://github.com/biniamf/pocs/tree/main/libwebsockets_sshd-parse-ic-unbounded-alloc	exploit
https://github.com/biniamf/pocs/blob/main/libwebsockets_sshd-parse-ic-unbounded-alloc/poc_sshd_unbounded_alloc.py	exploit
https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498	patch
https://github.com/warmcat/libwebsockets/	product

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.