diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-10650.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-10650.patch
new file mode 100644
index 0000000000..5846b3616d
--- /dev/null
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-10650.patch
@@ -0,0 +1,46 @@
+From 3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498 Mon Sep 17 00:00:00 2001
+From: Biniam F Demissie <biniamfd@gmail.com>
+Date: Wed, 13 May 2026 04:25:55 +0100
+Subject: [PATCH] ssh: plugin: add limit to resource exhaustion
+
+CVE: CVE-2026-10650
+Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498]
+Signed-off-by: Peter Marko <peter.marko@siemens.com>
+---
+ plugins/ssh-base/sshd.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/plugins/ssh-base/sshd.c b/plugins/ssh-base/sshd.c
+index ea35cb8b7..c849644d4 100644
+--- a/plugins/ssh-base/sshd.c
++++ b/plugins/ssh-base/sshd.c
+@@ -1,7 +1,7 @@
+ /*
+  * libwebsockets - small server side websockets and web server implementation
+  *
+- * Copyright (C) 2010 - 2019 Andy Green <andy@warmcat.com>
++ * Copyright (C) 2010 - 2026 Andy Green <andy@warmcat.com>
+  *
+  * Permission is hereby granted, free of charge, to any person obtaining a copy
+  * of this software and associated documentation files (the "Software"), to
+@@ -28,6 +28,8 @@
+ #include <string.h>
+ #include <stdlib.h>
+ 
++#define LWS_SSH_MAX_PACKET_SIZE  (256 * 1024)
++
+ void *sshd_zalloc(size_t s)
+ {
+ 	void *p = malloc(s);
+@@ -592,6 +594,11 @@ again:
+ 			pss->parser_state = SSHS_MSG_PADDING;
+ 			pss->ctr = 0;
+ 			pss->pos = 4;
++
++			if (pss->msg_len > LWS_SSH_MAX_PACKET_SIZE) {
++				lwsl_notice("msg size %u exceeds maximum\n", pss->msg_len);
++				goto bail;
++			}
+ 			if (pss->msg_len < 2 + 4) {
+ 				lwsl_notice("illegal msg size\n");
+ 				goto bail;
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
index f6d20c1d95..3015b7d165 100644
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.5.8.bb
@@ -7,7 +7,10 @@ DEPENDS = "zlib"
 DEPENDS:append:class-native = " libcap-native"
 
 SRCREV = "fbb0baf6af9c4324f0f1591734c78b0089b599d4"
-SRC_URI = "git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.5-stable;tag=v${PV}"
+SRC_URI = " \
+    git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.5-stable;tag=v${PV} \
+    file://CVE-2026-10650.patch \
+"
 
 UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases"
 UPSTREAM_CHECK_GITTAGREGEX = "v(?P<pver>\d+(\.\d+)+)"