ZeroDay Findings
Sign inSign up

Findings

CVE-2026-19773

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Published Aug 24, 2026

This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19773.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 24, 2026 · Catalog

    Detected

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19773.

Sources

  • CVE.orgCVE-2026-19773

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2026-19773

    30-day exploitation probability 0.6%

    first.org
  • Zero Day InitiativeZDI-26-590

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of libwebsockets. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 9.8. The following CVEs are assigned: CVE-2026-19773.

    zerodayinitiative.com