CVE-2026-10650: libwebsockets SSH DoS Vulnerability

CVE-2026-10650 Overview

CVE-2026-10650 is a resource consumption vulnerability [CWE-400] in warmcat libwebsockets versions up to and including 4.5.8. The flaw resides in the lws_ssh_parse_plaintext function within plugins/protocol_lws_ssh_base/sshd.c, part of the SSH Protocol Handler component. An attacker can manipulate the msg_len argument to trigger unbounded memory allocation. The vulnerability is remotely exploitable without authentication or user interaction. A public proof-of-concept exists, and a patch identified by commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 has been released by the maintainers.

Critical Impact
Remote, unauthenticated attackers can exhaust memory resources on services that embed the libwebsockets SSH daemon plugin, leading to denial of service against availability.

Affected Products

warmcat libwebsockets up to and including version 4.5.8
Applications embedding the protocol_lws_ssh_base plugin (sshd.c)
Services exposing the libwebsockets-based SSH protocol handler over the network

Discovery Timeline

2026-06-02 - CVE-2026-10650 published to NVD
2026-06-04 - Last updated in NVD database

Technical Details for CVE-2026-10650

Vulnerability Analysis

The vulnerability is an uncontrolled resource consumption issue in the libwebsockets SSH server plugin. The lws_ssh_parse_plaintext function processes incoming SSH protocol messages and uses the attacker-controlled msg_len field to size memory allocations. Because the implementation does not enforce an upper bound or sanity-check the declared length against available resources, a remote attacker can submit crafted SSH packets that request arbitrarily large allocations. Repeated or sufficiently large requests drive the process toward memory exhaustion, degrading or terminating service for legitimate users. The attack does not require credentials and can be launched directly over the network.

Root Cause

The root cause is missing length validation on the msg_len parameter before allocation in plugins/protocol_lws_ssh_base/sshd.c. The SSH handler trusts the message-length field from the unauthenticated peer and passes it to an allocator without enforcing protocol-defined or implementation-defined maximums. This pattern maps directly to [CWE-400] Uncontrolled Resource Consumption.

Attack Vector

The attack vector is network-based. An attacker establishes a connection to a service that exposes the libwebsockets SSH protocol handler and sends a crafted plaintext SSH message with an inflated msg_len. The server allocates memory based on the declared size, consuming resources without first authenticating the peer. The public proof-of-concept demonstrates the unbounded allocation pattern. See the GitHub PoC Repository and the VulDB CVE Report for additional technical context.

Detection Methods for CVE-2026-10650

Indicators of Compromise

Sudden, sustained memory growth in processes linking libwebsockets and exposing the SSH plugin
Repeated SSH connections from the same source followed by abnormal allocation spikes
Out-of-memory (OOM) kills or service restarts on hosts running libwebsockets-based SSH endpoints
Inbound traffic to SSH listeners with malformed or oversized initial protocol messages

Detection Strategies

Inspect SSH protocol traffic for messages declaring abnormally large msg_len values before authentication completes
Monitor resident set size (RSS) and heap growth for processes hosting the protocol_lws_ssh_base plugin
Correlate connection rates to libwebsockets SSH listeners with allocator pressure and OOM events
Audit deployed software inventory for libwebsockets versions at or below 4.5.8

Monitoring Recommendations

Enable per-process memory ceilings and alert when libwebsockets-based services approach configured limits
Aggregate syslog and kernel OOM messages into a centralized logging or SIEM pipeline for trend analysis
Track connection counts and byte-volume baselines on SSH listener ports to surface anomalous pre-authentication activity

How to Mitigate CVE-2026-10650

Immediate Actions Required

Identify all hosts and applications that link warmcat libwebsockets 4.5.8 or earlier and expose the SSH protocol handler
Apply the upstream patch commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 and rebuild affected binaries
Restrict network exposure of libwebsockets-based SSH endpoints to trusted networks until patching is complete
Configure per-process memory and connection rate limits to constrain the impact of unbounded allocation attempts

Patch Information

The maintainers fixed this issue in the upstream repository. The patch is identified by commit 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. Review the change in the GitHub Commit Log and pull the latest release from the GitHub Project Repository. Rebuild and redeploy any application that statically or dynamically links the affected plugin.

Workarounds

Disable the protocol_lws_ssh_base plugin in builds that do not require SSH functionality
Place libwebsockets SSH listeners behind a network filter that drops oversized or malformed pre-authentication SSH messages
Apply operating-system level resource controls such as cgroups memory limits or systemdMemoryMax directives to contain allocation abuse
Rate-limit inbound connections to SSH listener ports at the firewall or reverse proxy layer

bash

# Configuration example
# Example systemd unit hardening for a service embedding libwebsockets SSH
[Service]
MemoryMax=256M
TasksMax=128
LimitNOFILE=1024