{"id":"CVE-2026-95114","details":"libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c. This allows a remote attacker to cause a denial of service","modified":"2026-10-15T07:08:45.020422409Z","published":"2026-10-13T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95114.json"},"references":[{"type":"WEB","url":"https://gist.github.com/1820893135-pixel/34d3bc35f74eb0807e73b1df3f15af42"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95114.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95114"},{"type":"REPORT","url":"https://github.com/warmcat/libwebsockets/issues/3664"},{"type":"FIX","url":"https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0"},{"type":"FIX","url":"https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/warmcat/libwebsockets","events":[{"introduced":"0"},{"fixed":"736a4a26fce344766bc6618df87bf32193829dd0"},{"fixed":"c404a205a98323a7f60e69fae532c5d26bf4a62a"}],"database_specific":{"source":"REFERENCES"}}],"versions":["sai-cbfd75cb9","sai-5e7b2a70a","sai-d7e586cee","sai-0384a8650","sai-bc69b6beb","sai-84d81cbb3","sai-72c29c450","sai-c5e00391b","sai-1c0e0a309","sai-045415dbe","sai-0300e5ac0","sai-7b26c3fed","sai-25355ce4c","sai-921f90ffb","sai-b06d43b77","sai-d775ea44e","sai-206bec3b4","sai-dc772a47a","sai-64bd3b755","sai-9cc5ef2ac","sai-9e1c70ac4","sai-2787ec61a","sai-b1c687cea","sai-5a86bc7d9","sai-608cc00ee","sai-4e59faf9d","sai-72efe529f","sai-1a749fcc4","sai-d56159af6","sai-0a2b28ad4","sai-6e1eaa96a","sai-882ca3fe6","sai-5a510c46b","sai-074875fbf","v4.5.0","v4.4.0","v4.3.0","v4.2.0","v4.2-rc1","v4.1.0","v4.0.0","v3.1.0","v3.0.0","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.1-pre3","v2.0.0","v1.7.0","v1.6.0-chrome48-firefox42","v1.5-chrome47-firefox41","master-test-2015-11-19-1","master-test-2015-11-06-1","v1.4-chrome43-firefox-36","v1.3-chrome37-firefox30","v1.23-chrome32-firefox24","v1.22-chrome26-firefox18","v1.21-chrome26-firefox18","v1.2-chrome26-firefox18","valgrind-clean","v1.1-chrome26-firefox18","v1.0-chrome25-firefox17","release-0.6","support-chrome-20-firefox-12","support-protocol-v8-chrome-15-firefox-6","support-protocol-v7","deflate-stream-support","release-0.5","release-0.4","release-0.3","release-0.2","release-0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95114.json","vanir_signatures":[{"source":"https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a","target":{"file":"lib/misc/lejp.c","function":"lejp_parse"},"deprecated":false,"digest":{"function_hash":"270892201335218956877967915364102700925","length":15755},"id":"CVE-2026-95114-17d27899","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-95114-49f8677c","signature_type":"Line","signature_version":"v1","source":"https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a","target":{"file":"lib/misc/lejp.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["238143084788085900580323416887858130306","50692394739208856651802219510088445033","84927927127821115520065404557642942136","215494834799152321771280630691095153392","23930286718403568619887457473133190642","279662707477426691791592756852708769748","261157938023675953066928776189336140187","146365533193777545944859907769769510814","210705794846820539323546467241869874773","303715639102360373361580253827261003631","74369676365486498722215044527873369233","101751406264422365901163837267211457077","201462836966459058190968225557110523107","106250221530682654264277443301668714021","261157938023675953066928776189336140187","145002801260366139247904137437741094657","45972145194831362185678579677333221389","280704518195769042487549686346696964349","110970410540041278624355412463155789395","222506981460656242529920301688731483871","201462836966459058190968225557110523107","106250221530682654264277443301668714021","261157938023675953066928776189336140187","145002801260366139247904137437741094657","45972145194831362185678579677333221389","280704518195769042487549686346696964349","330439790753133295779882025654484399572","42842076680187731675439441380365460449","277449606410721350791398736905130241494","106250221530682654264277443301668714021","261157938023675953066928776189336140187","146365533193777545944859907769769510814","107845757361920713018752043747234677478","28667609403046601959246165512656579609","11644975227428233148294583654352896033","130261494007937786473209827363924705042","261864398158834914135966859285377489395","85888651119426938046830556126205731213","230536542597687635486829012182910137047","219133545051982942496331186979895779724","126695880029921635805203733829690013891"]}},{"id":"CVE-2026-95114-d91110f5","signature_type":"Function","signature_version":"v1","source":"https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0","target":{"file":"lib/misc/lejp.c","function":"lejp_parse"},"deprecated":false,"digest":{"length":15755,"function_hash":"270892201335218956877967915364102700925"}},{"digest":{"line_hashes":["238143084788085900580323416887858130306","50692394739208856651802219510088445033","84927927127821115520065404557642942136","215494834799152321771280630691095153392","23930286718403568619887457473133190642","279662707477426691791592756852708769748","261157938023675953066928776189336140187","146365533193777545944859907769769510814","210705794846820539323546467241869874773","303715639102360373361580253827261003631","74369676365486498722215044527873369233","101751406264422365901163837267211457077","201462836966459058190968225557110523107","106250221530682654264277443301668714021","261157938023675953066928776189336140187","145002801260366139247904137437741094657","45972145194831362185678579677333221389","280704518195769042487549686346696964349","110970410540041278624355412463155789395","222506981460656242529920301688731483871","201462836966459058190968225557110523107","106250221530682654264277443301668714021","261157938023675953066928776189336140187","145002801260366139247904137437741094657","45972145194831362185678579677333221389","280704518195769042487549686346696964349","330439790753133295779882025654484399572","42842076680187731675439441380365460449","277449606410721350791398736905130241494","106250221530682654264277443301668714021","261157938023675953066928776189336140187","146365533193777545944859907769769510814","107845757361920713018752043747234677478","28667609403046601959246165512656579609","11644975227428233148294583654352896033","130261494007937786473209827363924705042","261864398158834914135966859285377489395","85888651119426938046830556126205731213","230536542597687635486829012182910137047","219133545051982942496331186979895779724","126695880029921635805203733829690013891"],"threshold":0.9},"id":"CVE-2026-95114-f06840aa","signature_type":"Line","signature_version":"v1","source":"https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0","target":{"file":"lib/misc/lejp.c"},"deprecated":false}],"vanir_signatures_modified":"2026-10-15T07:08:45Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}