CVE-2026-49846

libks , a foundational C library used by SignalWire products, contains a path traversal vulnerability in clean_uri(), its HTTP request parser. Prior to version 2.0.11 , URIs whose path exceeds the internal canonicalization buffer's segment capacity are silently passed through with embedded .. seq...

CVE-2026-49846 libks has path traversal in kws HTTP parser via URI segment overflow

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

PT-2026-90508

libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean uri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...