CVE-2026-50161Patch

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

libre is a generic library for real-time communications with asynchronous input and output support. Prior to 4.8.1, the websock_decode() function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64_MAX, causing the mbuf_get_left() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer. Applications using websock_accept() or websock_accept_proto() to implement a WebSocket server are affected, and exploitation can cause attacker-controlled heap corruption or denial of service after the HTTP WebSocket upgrade handshake. This issue is fixed in version 4.8.1.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-190CWE-787

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Full discourse1 post

Upwind Security MDR@UpwindMDR46d
Patch
🚨Critical - libre re WebSocket Masked Frame Integer Overflow OOB Write (CVE-2026-50161) libre (baresip/re) websock_decode() mishandles 64-bit extended payload lengths on masked frames, overflowing length math and bypassing bounds checks. A remote peer post-WebSocket upgrade can trigger out-of-bounds heap writes during XOR unmasking, leading to heap corruption or DoS. 👉Affected: re < 4.8.1 | Upgrade to 4.8.1
Post summary
A critical integer overflow in libre re’s WebSocket decoder (CVE-2026-50161) can cause heap corruption or DoS; the advisory recommends upgrading to re 4.8.1 to mitigate the issue.
0000089
292 followersView on X

Explore more

Back to dashboard