CVE-2026-10650: Libwebsockets SSH Handler Resource Exhaustion Vulnerability

Technical summary

The vulnerability exists in the lws_ssh_parse_plaintext function within plugins/protocol_lws_ssh_base/sshd.c in libwebsockets versions up to 4.5.8. By crafting malicious SSH protocol messages with manipulated msg_len arguments, an unauthenticated remote attacker can trigger excessive resource consumption, leading to denial of service. The flaw is classified under CWE-400 (Uncontrolled Resource Consumption) and CWE-404 (Improper Resource Validation), indicating insufficient bounds checking or validation of the message length parameter before resource allocation.

Business impact

Organizations deploying libwebsockets as an SSH server component face availability risk. A successful attack can render SSH services unresponsive, disrupting remote administration, secure file transfers, or any SSH-dependent workflows. Since no authentication is required, any internet-facing SSH implementation using the affected library is exposed. The business impact is primarily operational disruption rather than data breach, but extended downtime of administrative services can cascade into broader infrastructure issues.

Affected systems

Libwebsockets versions up to and including 4.5.8 are vulnerable if compiled with or actively using the SSH protocol handler plugin. Systems that use libwebsockets for WebSocket communication but do not enable or load the SSH protocol component are not affected. Verify your build configuration and loaded plugins. Embedded systems, IoT devices, and custom applications leveraging libwebsockets for SSH services are at highest risk.

Exploitability

Exploitability is straightforward: the attack vector is network-based, requires no authentication, and no user interaction. An attacker can send specially crafted SSH protocol frames remotely. The attack complexity is low. A working exploit has been publicly disclosed, lowering the barrier to weaponization. Organizations should assume this is actively being scanned for and tested in the wild.

Remediation

Apply the security patch identified by commit hash 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 or upgrade to a patched version of libwebsockets released after the fix. Verify against the vendor advisory for the specific version number and release date. If immediate patching is not feasible, disable or unload the SSH protocol handler plugin if your application does not require SSH functionality, or restrict SSH access via network segmentation and firewalls to trusted sources only.

Patch guidance

The vendor has issued a fix referenced by commit hash 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498. Consult the official libwebsockets repository or security advisory to identify the corresponding version release containing this commit. Test the patched version in a staging environment to confirm SSH functionality remains intact and resource consumption is normalized under load. Rollout patches to production systems on an expedited timeline given public exploit availability.

Detection guidance

Monitor SSH service logs for unusual connection patterns, rapid connection establishment and disconnection, or repeated malformed SSH handshakes from the same source. Network intrusion detection systems (IDS) may identify abnormal SSH protocol framing or oversized message length fields. Resource monitoring on systems running libwebsockets SSH components should trigger alerts on unexplained CPU or memory spikes coinciding with SSH traffic. Consider deploying rate-limiting on SSH endpoints to mitigate the attack surface.

Why prioritize this

Although the CVSS score is moderate (5.3), the vulnerability warrants prioritized remediation because: (1) exploit code is publicly available, increasing attack likelihood; (2) authentication is not required, making every SSH-enabled instance a potential target; (3) the vector is remote and low-complexity; (4) denial-of-service of administrative services can have outsized operational impact. Organizations should treat this as a priority patch candidate despite the medium severity rating.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-reachable attack requiring no privileges or user interaction, resulting in availability loss but no confidentiality or integrity impact. The score is moderate rather than high because the attack causes service degradation rather than system compromise or data exfiltration. However, the real-world risk is elevated by public exploit availability and the critical nature of SSH for infrastructure management, warranting prioritization above the raw score might suggest.

Frequently asked questions