{"id":"CVE-2026-95115","details":"Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser","modified":"2026-10-16T02:47:51.370663084Z","published":"2026-10-13T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95115.json"},"references":[{"type":"WEB","url":"https://gist.github.com/1820893135-pixel/d4246b2ecc927193ea1fad50810e9901"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/95xxx/CVE-2026-95115.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95115"},{"type":"REPORT","url":"https://github.com/warmcat/libwebsockets/issues/3663"},{"type":"FIX","url":"https://github.com/warmcat/libwebsockets/commit/736a4a26fce344766bc6618df87bf32193829dd0"},{"type":"FIX","url":"https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/warmcat/libwebsockets","events":[{"introduced":"0"},{"fixed":"736a4a26fce344766bc6618df87bf32193829dd0"},{"fixed":"c404a205a98323a7f60e69fae532c5d26bf4a62a"}],"database_specific":{"source":"REFERENCES"}}],"versions":["sai-cbfd75cb9","sai-5e7b2a70a","sai-d7e586cee","sai-0384a8650","sai-bc69b6beb","sai-84d81cbb3","sai-72c29c450","sai-c5e00391b","sai-1c0e0a309","sai-045415dbe","sai-0300e5ac0","sai-7b26c3fed","sai-25355ce4c","sai-921f90ffb","sai-b06d43b77","sai-d775ea44e","sai-206bec3b4","sai-dc772a47a","sai-64bd3b755","sai-9cc5ef2ac","sai-9e1c70ac4","sai-2787ec61a","sai-b1c687cea","sai-5a86bc7d9","sai-608cc00ee","sai-4e59faf9d","sai-72efe529f","sai-1a749fcc4","sai-d56159af6","sai-0a2b28ad4","sai-6e1eaa96a","sai-882ca3fe6","sai-5a510c46b","sai-074875fbf","v4.5.0","v4.4.0","v4.3.0","v4.2.0","v4.2-rc1","v4.1.0","v4.0.0","v3.1.0","v3.0.0","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.1-pre3","v2.0.0","v1.7.0","v1.6.0-chrome48-firefox42","v1.5-chrome47-firefox41","master-test-2015-11-19-1","master-test-2015-11-06-1","v1.4-chrome43-firefox-36","v1.3-chrome37-firefox30","v1.23-chrome32-firefox24","v1.22-chrome26-firefox18","v1.21-chrome26-firefox18","v1.2-chrome26-firefox18","valgrind-clean","v1.1-chrome26-firefox18","v1.0-chrome25-firefox17","release-0.6","support-chrome-20-firefox-12","support-protocol-v8-chrome-15-firefox-6","support-protocol-v7","deflate-stream-support","release-0.5","release-0.4","release-0.3","release-0.2","release-0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-95115.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}