VulnSocial

CVE-2026-19773Patch

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-09-19: 1Patch / Workaround · 2026-09-19: 1Technical Details · 2026-09-19: 109-19
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 CRITICAL: CVE-2026-19773 (CVSS 9.8) libwebsockets HTTP/2 HPACK parsing flaw allows unauthenticated RCE. Out-of-bounds write in path header parsing. Patch immediately. #CVE #PatchNow https://t.co/1O0jssK7FO

    Post summary

    The tweet announces CVE-2026-19773, an unauthenticated RCE in libwebsockets, and urges immediate patching, fitting the Patch classification.

    0000029
    139 followersView on X

Explore more

Back to dashboard