CVE-2026-19773: libwebsockets HTTP/2 HPACK RCE Vulnerability

CVE-2026-19773 Overview

CVE-2026-19773 is an out-of-bounds write vulnerability in the libwebsockets library affecting the HTTP/2 HPACK path header parser. Remote attackers can exploit this flaw without authentication to execute arbitrary code in the context of the vulnerable process. The issue stems from missing bounds validation on user-supplied header data written into an allocated header buffer. The Zero Day Initiative tracked this issue as ZDI-CAN-31036 and published advisory ZDI-26-590. The vulnerability is classified under CWE-787: Out-of-bounds Write.

Critical Impact
Unauthenticated remote attackers can send crafted HTTP/2 requests to trigger a buffer overflow and achieve arbitrary code execution on any server built with a vulnerable libwebsockets version.

Affected Products

libwebsockets (server-side HTTP/2 handling)
Applications and appliances embedding vulnerable libwebsockets builds prior to commit 824151862f37bc72f46d9a3e01d5b9408d313a0b
IoT firmware and embedded devices linking libwebsockets for HTTP/2 support

Discovery Timeline

2026-09-15 - CVE-2026-19773 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19773

Vulnerability Analysis

The defect resides in the HTTP/2 HPACK header decoder inside lib/roles/h2/hpack.c. When the server decodes a compressed :path pseudo-header, each decoded byte is appended to the per-connection allocated_headers buffer using ah->data[ah->pos++] = (char)c;. The original code path incremented ah->pos without confirming that the write position remained within max_http_header_data. A remote attacker who sends a crafted HPACK-encoded path header longer than the configured header buffer writes past the end of the allocation, corrupting adjacent heap memory. Depending on the heap layout, this corruption can be shaped into arbitrary code execution within the process hosting the libwebsockets server.

Root Cause

The root cause is a missing boundary check on ah->pos before writing decoded HPACK bytes into ah->data. The header decoder trusted the incoming compressed stream to stay within the buffer limit rather than enforcing that limit on every write. This is a classic [CWE-787] out-of-bounds write in C code operating on attacker-controlled length fields.

Attack Vector

Exploitation requires only network reachability to a vulnerable HTTP/2 endpoint. No authentication or user interaction is needed. An attacker establishes an HTTP/2 session, then transmits a HEADERS frame with an HPACK-encoded :path value long enough to exceed the server's max_http_header_data setting. The overflow occurs during header decoding, well before any application-level routing or authorization runs.

// Security patch in lib/roles/h2/hpack.c (zdi-can-31036: h2 bounds check on server)
 {
 	struct allocated_headers *ah = wsi->http.ah;
 
+	if ((unsigned int)ah->pos >= wsi->a.context->max_http_header_data)
+		return 1;
+
 	ah->data[ah->pos++] = (char)c;
 	ah->frags[ah->nfrag].len++;

Source: warmcat/libwebsockets commit 8241518

The patch adds an explicit guard that returns an error when ah->pos reaches max_http_header_data, preventing the append beyond the allocated buffer.

Detection Methods for CVE-2026-19773

Indicators of Compromise

HTTP/2 HEADERS frames containing unusually long :path pseudo-headers targeting libwebsockets-based services
Server processes crashing with SIGSEGV or heap corruption traces shortly after receiving HTTP/2 traffic
Unexpected child processes, reverse shells, or outbound connections originating from a libwebsockets server process

Detection Strategies

Inventory build manifests, SBOMs, and container images for libwebsockets versions predating commit 824151862f37bc72f46d9a3e01d5b9408d313a0b
Deploy network signatures on web application firewalls or IDS platforms that flag HTTP/2 requests with oversized :path headers exceeding the negotiated SETTINGS_MAX_HEADER_LIST_SIZE
Correlate application crash telemetry with concurrent HTTP/2 traffic spikes to identify probing attempts

Monitoring Recommendations

Enable core dump collection and stack trace forwarding on hosts running libwebsockets HTTP/2 servers
Monitor for anomalous process creation from web service parents using endpoint detection and response tooling
Log HTTP/2 frame-level metadata, including header length distributions, and alert on statistical outliers

How to Mitigate CVE-2026-19773

Immediate Actions Required

Rebuild and redeploy all software linking libwebsockets after applying commit 824151862f37bc72f46d9a3e01d5b9408d313a0b
Identify embedded devices, appliances, and third-party products that ship libwebsockets and request vendor-supplied firmware updates
Restrict inbound HTTP/2 access to trusted networks until patched builds are deployed

Patch Information

The upstream fix is available in the warmcat/libwebsockets repository as commit 8241518. The patch adds a bounds check in lib/roles/h2/hpack.c that rejects further header bytes once ah->pos reaches wsi->a.context->max_http_header_data. Additional context is available in the Zero Day Initiative Advisory ZDI-26-590.

Workarounds

Disable HTTP/2 support on libwebsockets-based services where the protocol is not required, forcing clients to HTTP/1.1
Place a hardened HTTP/2-aware reverse proxy in front of vulnerable services to normalize and length-limit incoming headers
Lower max_http_header_data and enforce strict client header size limits at the network edge to reduce the exploitable window

bash

# Example: rebuild libwebsockets from a patched source tree
git clone https://github.com/warmcat/libwebsockets.git
cd libwebsockets
git checkout 824151862f37bc72f46d9a3e01d5b9408d313a0b
mkdir build && cd build
cmake .. -DLWS_WITH_HTTP2=ON
make -j"$(nproc)"
sudo make install
sudo ldconfig