Stack-based buffer overflow in libwebsockets - CVE-2025-11678

Vulnerability identifier: #VU117948

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-11678

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the lws_adns_parse_label() function in lib/system/async-dns/async-dns-parse.c. A remote unauthenticated attacker can trigger a stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

libwebsockets
openEuler
Ubuntu
libwebsockets (Ubuntu package)
libwebsockets (Red Hat package)
libwebsockets
libwebsockets-debuginfo
libwebsockets-debugsource
libwebsockets-devel
libwebsockets-help
Red Hat OpenStack

Install updates from vendor's website.

libwebsockets (Ubuntu package) - addressed in versions 3.2.1-3ubuntu0.1~esm1, 4.0.20-2ubuntu1.1, 4.3.3-1.1ubuntu0.1~esm1
libwebsockets (Red Hat package) - update to 4.3.0-2.el9ost
libwebsockets - update to 4.3.0-7
libwebsockets-debuginfo - update to 4.3.0-7
libwebsockets-debugsource - update to 4.3.0-7
libwebsockets-devel - update to 4.3.0-7
libwebsockets-help - update to 4.3.0-7
Red Hat OpenStack - update to 17.1

• https://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a
• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11678

• Multiple vulnerabilities in libwebsockets
• openEuler update for libwebsockets
• Stack-based buffer overflow in Red Hat OpenStack 17.1 packages
• Ubuntu update for libwebsockets