CVE-2025-11677 – Use After Free in libwebsockets WebSocket server

CVE ID : CVE-2025-11677

Published : Oct. 20, 2025, 2:15 p.m. | 26 minutes ago

Description : Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.

Severity: 6.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…