What’s Vulnerable › Vulnerabilities

CVE-2025-11678: Stack-based Buffer Overflow in libwebsockets DNS response parsing

• Severity: high (CVSS 7.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-10-20 · updated 2026-10-08
• Weakness: CWE-121

Description

Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.

Affected products

• warmcat libwebsocket: from 4.0 through 4.4.2; from 4.0 through 4.3.6

References

• https://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a
• https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11678

Get alerted when CVE-2025-11678 or the next vulnerability affects your stack