CVE-2025-11677
- Published: 2025-10-20T14:15:39.357
- Last modified: 1761075085
Summary
🛡️ Vulnerability overview CVE-2025-11677 Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service. 📊 Technical details Severity: CVSS: Vendor: 🧩 Affected products Not specified. 🚨 Recommended mitigations Update to the latest available version Monitor logs and network traffic Apply least-privilege and segment the network 🔗 References https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971ahttps://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677 🧭 Related vulnerabilities No related CVEs. Subscribe for CVE…
Technical details
Severity & risk metrics
Affected products & vendors
Vendors not specified.
Exploit & mitigation
No vendor patch links provided.
References & resources
No references.
🛡️ Vulnerability overview CVE-2025-11677
Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.
📊 Technical details
- Severity:
- CVSS:
- Vendor:
🧩 Affected products
- Not specified.
🚨 Recommended mitigations
- Update to the latest available version
- Monitor logs and network traffic
- Apply least-privilege and segment the network
🔗 References
- https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a
- https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677
🧭 Related vulnerabilities
- No related CVEs.
Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.
Related CVE by CWE
No related CWE found.
Top CVE for Vendor
No vendor taxonomy on this entry.
Recently Exploited Similar Vulnerabilities
No recent KEV-listed items for this vendor/product.
How to fix CVE-2025-11677
Description: Summary 🛡️ Vulnerability overview CVE-2025-11677 Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service. 📊 Technical details Severity: CVSS: Vendor: 🧩 Affected products Not specified. 🚨 Recommended mitigations Update to the […]
Exploit Difficulty: HARD
⏱️ Time to exploit: > 4 hours
🛠️ Required skills: Advanced security expertise
💰 Public exploits: Rare or not public
How to Fix:
- Check if you're running the affected product
- Update to the latest patched version
- If patching is not immediately possible: restrict network exposure, apply least-privilege access
- Test the fix in a staging environment first
- Review logs for signs of exploitation
- Monitor for IOCs (Indicators of Compromise)
- Enable automatic security updates
- Set up vulnerability monitoring
- Review and harden security configurations
Vendor Advisory: https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971ahttps://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677
Exploit Difficulty Assessment
Vulnerability Timeline
CVE details first published to NVD database
CVE details were updated
Added to this CVE tracking system
Detection Rules & IOCs
No specific detection rules generated for this vulnerability type.
No vendor/product data available.