Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the lwshandshakeserver function when a user-provided callback handles LWSCALLBACKHTTPCONFIRMUPGRADE. An attacker can cause a crash or disrupt service by triggering the callback under specific conditions. Note: This is...

CVE-2025-11677

CVE-2025-11677 is a Use After Free in the warmcat libwebsockets WebSocket server (lws_handshake_server). The vulnerability triggers in configurations where a user-supplied callback handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, potentially allowing a denial-of-service. Public advisories reference aff...