- What: Two vulnerabilities were discovered in Libwebsockets related to memory handling and buffer size checking.
- Impact: An attacker could cause a denial of service or potentially execute arbitrary code.
- Affected: Ubuntu 22.04 LTS and Ubuntu 24.04 LTS.
- CVE: CVE-2025-11677, CVE-2025-11678
Raffaele Bova discovered that Libwebsockets incorrectly handled memory when the upgrade header is not valid in the WebSocket server. An attacker could possibly use this issue to cause a denial of service. (CVE-2025-11677) Raffaele Bova discovered that Libwebsockets did not properly check the size of the destination buffer in the async-dns component. An attacker could possibly use this issue to cause applications to crash, leading to a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-11678)