diff mbox series

[scarthgap,meta-oe,v2,2/2] libwebsockets: fix CVE-2026-19773

Message ID 20260923-update-libwebsockets-fix-cve-2026-19773-v2-2-d20d96496e90@bootlin.com
State New
Headers show
Series libwebsockets: update to 4.3.10 and fix CVE-2026-19773 | expand

Commit Message

Benjamin Robin (Schneider Electric) Sept. 23, 2026, 1:30 p.m. UTC 
Backport the fix from v5 branch.

Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
---
 .../libwebsockets/CVE-2026-19773.patch             | 32 ++++++++++++++++++++++
 .../libwebsockets/libwebsockets_4.3.10.bb          |  1 +
 2 files changed, 33 insertions(+)
diff mbox series

Patch

diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch
new file mode 100644
index 000000000000..fe814201ea81
--- /dev/null
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets/CVE-2026-19773.patch
@@ -0,0 +1,32 @@ 
+From 7a57bcaa5a6ef336d92759676b46d04e5a79e63d Mon Sep 17 00:00:00 2001
+From: Andy Green <andy@warmcat.com>
+Date: Fri, 3 Jul 2026 18:43:25 +0100
+Subject: [PATCH] zdi-can-31036: h2 bounds check on server
+
+This vulnerability was discovered by:
+Maher Azzouzi working with TrendAI Zero Day Initiative
+
+CVE: CVE-2026-19773
+Upstream-Status: Backport [https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b]
+
+Signed-off-by: Benjamin Robin (Schneider Electric) <benjamin.robin@bootlin.com>
+---
+ lib/roles/h2/hpack.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/roles/h2/hpack.c b/lib/roles/h2/hpack.c
+index f6aefd34ded3..e6d8d06c1d8f 100644
+--- a/lib/roles/h2/hpack.c
++++ b/lib/roles/h2/hpack.c
+@@ -274,6 +274,9 @@ static int lws_frag_append(struct lws *wsi, unsigned char c)
+ {
+	struct allocated_headers *ah = wsi->http.ah;
+
++	if ((unsigned int)ah->pos >= wsi->a.context->max_http_header_data)
++		return 1;
++
+	ah->data[ah->pos++] = (char)c;
+	ah->frags[ah->nfrag].len++;
+
+--
+2.55.0
diff --git a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.10.bb b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.10.bb
index 559253c9613b..57db93bc1d9f 100644
--- a/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.10.bb
+++ b/meta-oe/recipes-connectivity/libwebsockets/libwebsockets_4.3.10.bb
@@ -10,6 +10,7 @@  S = "${WORKDIR}/git"
 SRCREV = "2288cf200bc1c28680765bd4f07e437356106c2d"
 SRC_URI = "git://github.com/warmcat/libwebsockets.git;protocol=https;branch=v4.3-stable \
           file://CVE-2026-10650.patch \
+          file://CVE-2026-19773.patch \
           "
 
 UPSTREAM_CHECK_URI = "https://github.com/warmcat/${BPN}/releases"