Critical Remote Code Execution in libwebsockets (CVE-2026-19773) via HTTP/2 HPACK Path Header Parsing
What It Is — libwebsockets’ HTTP/2 HPACK path‑header parser contains an out‑of‑bounds write that can be triggered by crafted network traffic. The flaw allows an unauthenticated attacker to execute arbitrary code in the context of the vulnerable process.
Exploitability — The vulnerability is remotely exploitable with no authentication required; a proof‑of‑concept exists. CVSS 9.8 (Critical).
Affected Products — libwebsockets library (all versions prior to the 4.3.2 patch).
Why It Matters for Compliance & Audit Readiness
- Demonstrates the necessity of continuous third‑party component monitoring to satisfy SOC 2 vendor‑management controls (CC6.1).
- Patch‑management evidence must be captured and retained as part of the audit trail for CC7.2.
- Maintaining an up‑to‑date Software Bill of Materials (SBOM) provides defensible proof that high‑severity libraries are remediated.
Recommended Actions
- Inventory every service that embeds libwebsockets and verify the version.
- Apply the vendor‑released patch (≥ 4.3.2) immediately and record the change in your change‑management system.
- Integrate libwebsockets into an automated SBOM and vulnerability‑scanning pipeline for continuous monitoring.
- Document the risk assessment and mitigation steps in your vendor‑risk program to provide SOC 2 audit evidence.
Source: Zero Day Initiative Advisory – ZDI‑26‑590 (CVE‑2026‑19773)