CVE-2025-11677

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-11677", "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "state": "PUBLISHED", "assignerShortName": "Nozomi", "dateReserved": "2025-10-13T09:56:10.952Z", "datePublished": "2025-10-20T13:41:10.787Z", "dateUpdated": "2025-10-24T10:54:30.961Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://libwebsockets.org/git/libwebsockets", "defaultStatus": "unaffected", "modules": ["lws_handshake_server"], "product": "libwebsockets", "vendor": "warmcat", "versions": [{"lessThanOrEqual": "4.4.1,4.3.6", "status": "affected", "version": "3", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:warmcat:libwebsockets:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.4.1,4.3.6", "versionStartIncluding": "3", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "OR"}], "credits": [{"lang": "en", "type": "finder", "value": "Raffaele Bova at Nozomi Networks"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service."}], "value": "Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles\u00a0LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6.3, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-416", "description": "CWE-416 Use After Free", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "shortName": "Nozomi", "dateUpdated": "2025-10-24T10:54:30.961Z"}, "references": [{"tags": ["patch", "vendor-advisory"], "url": "https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a"}, {"tags": ["third-party-advisory"], "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the library to its latest stable release, if not possible backport the fix commit 2f082ec31261f556969160143ba94875d783971a"}], "value": "Update the library to its latest stable release, if not possible backport the fix commit 2f082ec31261f556969160143ba94875d783971a"}], "source": {"discovery": "EXTERNAL"}, "title": "Use After Free in libwebsockets WebSocket server", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T13:53:56.413873Z", "id": "CVE-2025-11677", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T13:54:19.569Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11677", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T13:53:56.413873Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T13:54:12.114Z"}}], "cna": {"title": "Use After Free in libwebsockets WebSocket server", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Raffaele Bova at Nozomi Networks"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "warmcat", "modules": ["lws_handshake_server"], "product": "libwebsockets", "versions": [{"status": "affected", "version": "3", "versionType": "semver", "lessThanOrEqual": "4.4.1,4.3.6"}], "collectionURL": "https://libwebsockets.org/git/libwebsockets", "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the library to its latest stable release, if not possible backport the fix commit 2f082ec31261f556969160143ba94875d783971a", "supportingMedia": [{"type": "text/html", "value": "Update the library to its latest stable release, if not possible backport the fix commit 2f082ec31261f556969160143ba94875d783971a", "base64": false}]}], "references": [{"url": "https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a", "tags": ["patch", "vendor-advisory"]}, {"url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles\u00a0LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.", "supportingMedia": [{"type": "text/html", "value": "Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:warmcat:libwebsockets:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "4.4.1,4.3.6", "versionStartIncluding": "3"}], "operator": "OR"}], "operator": "OR"}], "providerMetadata": {"orgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "shortName": "Nozomi", "dateUpdated": "2025-10-24T10:54:30.961Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11677", "state": "PUBLISHED", "dateUpdated": "2025-10-24T10:54:30.961Z", "dateReserved": "2025-10-13T09:56:10.952Z", "assignerOrgId": "bec8025f-a851-46e5-b3a3-058e6b0aa23c", "datePublished": "2025-10-20T13:41:10.787Z", "assignerShortName": "Nozomi"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"collectionURL": "https://libwebsockets.org/git/libwebsockets", "defaultStatus": "unaffected", "modules": ["lws_handshake_server"], "product": "libwebsockets", "vendor": "warmcat", "versions": [{"lessThanOrEqual": "4.4.1,4.3.6", "status": "affected", "version": "3", "versionType": "semver"}]}], "source": "prodsec@nozominetworks.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles\u00a0LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service."}, {"lang": "es", "value": "Uso Despu\u00e9s de Liberar en la implementaci\u00f3n del servidor WebSocket en lws_handshake_server en warmcat libwebsockets puede permitir a un atacante, en configuraciones espec\u00edficas donde el usuario proporciona una funci\u00f3n de devoluci\u00f3n de llamada que maneja LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, lograr la denegaci\u00f3n de servicio."}], "id": "CVE-2025-11677", "lastModified": "2026-10-08T22:10:00.563", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "prodsec@nozominetworks.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11677", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T13:53:56.413873Z", "version": "2.0.3"}}]}, "published": "2025-10-20T14:15:39.357", "references": [{"source": "prodsec@nozominetworks.com", "url": "https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a"}, {"source": "prodsec@nozominetworks.com", "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677"}], "sourceIdentifier": "prodsec@nozominetworks.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "prodsec@nozominetworks.com", "type": "Secondary"}]}

{"bugzilla": {"description": "libwebsockets: Use After Free in libwebsockets WebSocket server", "id": "2405127", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2405127"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-416", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2025-11677", "package_state": [{"cpe": "cpe:/a:redhat:amq_interconnect:1", "fix_state": "Fix deferred", "package_name": "libwebsockets", "product_name": "A-MQ Interconnect 1"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Fix deferred", "package_name": "libwebsockets", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Fix deferred", "package_name": "libwebsockets", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:service_interconnect:2", "fix_state": "Fix deferred", "package_name": "libwebsockets", "product_name": "Red Hat Service Interconnect 2"}], "public_date": "2025-10-20T13:41:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-11677\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-11677\nhttps://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a\nhttps://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677"], "threat_severity": "Low"}

{"created": "2025-10-21T09:39:46.375819+00:00", "updated": "2025-10-21T09:39:46.375843+00:00", "vendors": ["warmcat", "warmcat$PRODUCT$libwebsockets"]}