CVE-2026-19773
CRITICAL · 9.8High CVSS and early chatter, but "active exploit" claim unverified; no KEV, no PoC, no vendor response visible day-one.
What: libwebsockets HTTP/2 HPACK path header parser lacks input validation, allowing unauthenticated remote attackers to write past buffer boundaries and execute arbitrary code (CVSS 9.8 CRITICAL).
Why it matters: Published today with CVSS 9.8 and no authentication required, but not yet KEV-listed. Social chatter claims "active exploitation" as 0day, but no public PoC, vendor advisory timeline, or defender reports visible. Claims lack corroborating evidence.
Where it's seen: Bluesky posts amplifying NVD description with "actively exploited" language; links to third-party CVE aggregators. No vendor patching announcements, researcher PoC, or CISA advisory found yet.
RISK: CRITICAL — Unauthenticated RCE in widely-used library; requires patch assessment and exposure scanning.
Description
libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of HTTP/2 HPACK path header. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31036.
CVSS 3.0 breakdown
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High