Bug 2484180 (CVE-2026-10650)

Summary:	CVE-2026-10650 libwebsockets: libwebsockets: Denial of Service via SSH Protocol Handler resource consumption
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	ansmith, eglynn, jjoyce, jpretori, jschluet, lhh, mburns, mgarciac, peholase, pjindal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in libwebsockets, specifically within its SSH Protocol Handler component. A remote attacker can exploit this vulnerability by manipulating the 'msg_len' argument in the 'lws_ssh_parse_plaintext' function. This manipulation can lead to excessive resource consumption, resulting in a Denial of Service (DoS) condition for the affected system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2487518, 2487519
Bug Blocks:

Description OSIDB Bzimport 2026-06-02 22:01:28 UTC

A flaw has been found in warmcat libwebsockets up to 4.5.8. This issue affects the function lws_ssh_parse_plaintext of the file plugins/protocol_lws_ssh_base/sshd.c of the component SSH Protocol Handler. Executing a manipulation of the argument msg_len can lead to resource consumption. The attack may be launched remotely. The exploit has been published and may be used. This patch is called 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. A patch should be applied to remediate this issue.