CVE-2026-10650 in libwebsockets
Summary
by MITRE • 06/03/2026
A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/11/2026
The vulnerability in warmcat libwebsockets affects the SSH Protocol Handler component through a flaw in the lws_ssh_parse_plaintext function located in plugins/protocol_lws_ssh_base/sshd.c. This issue represents a resource consumption vulnerability that can be exploited remotely, making it particularly dangerous for systems that expose SSH services through this library. The vulnerability arises from improper handling of the msg_len argument during SSH message parsing, which allows attackers to manipulate input parameters in ways that consume excessive system resources. The attack vector is remote, meaning that adversaries can exploit this weakness without requiring physical access to the target system, making it a significant concern for networked applications using libwebsockets for SSH functionality.
The technical nature of this vulnerability aligns with CWE-400, which catalogs weaknesses related to resource exhaustion, and specifically addresses improper input validation in protocol handling components. The flaw demonstrates how seemingly benign parameter manipulation can lead to substantial system impact when the library fails to properly validate or constrain input values during SSH message processing. Attackers can leverage this vulnerability to perform resource exhaustion attacks that may lead to denial of service conditions, system instability, or performance degradation that affects legitimate users of the SSH service. The published exploit demonstrates that this vulnerability is not theoretical but actively being used in the wild, increasing the urgency for remediation.
The operational impact of this vulnerability extends beyond simple denial of service scenarios as it can affect the availability and reliability of SSH services that depend on libwebsockets. Systems using affected versions may experience cascading failures where resource exhaustion leads to service unavailability, potentially affecting multiple concurrent connections or even complete system shutdowns. The vulnerability's remote exploitation capability means that attackers can target systems from anywhere on the network, making it particularly dangerous for publicly exposed SSH services. Organizations relying on libwebsockets for SSH implementations should consider the broader implications for their security posture, as this vulnerability could be used as a stepping stone for more sophisticated attacks or to disrupt critical infrastructure services.
Mitigation strategies should prioritize immediate patch application using the referenced commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 which addresses the specific resource consumption issue in the SSH protocol handler. Organizations should also implement network monitoring to detect unusual resource consumption patterns that may indicate exploitation attempts, and consider rate limiting or connection throttling mechanisms to reduce the impact of potential attacks. Additionally, regular security assessments of all components using libwebsockets should be conducted to identify similar vulnerabilities, with particular attention to protocol handler implementations that process external input. The vulnerability serves as a reminder of the critical importance of proper input validation and resource management in network protocol implementations, especially those handling authentication and secure communication channels that are fundamental to enterprise security infrastructure.