CVE-2025-11677CWE-416

CVE-2025-11677

published October 20, 2025

CVSS
6.3
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00405 · 33.6th percentile
Weakness
CWE-416 · Use After Free
Published
2025-10-20T18:15Z
References (2)
https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a · [email protected]https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677 · [email protected]
EPSS history
Timeline
  • 20 OCT 13:41Z
    Use After Free in libwebsockets WebSocket server
    cvelistv5