Vulnerability · Published Oct 20, 2025 · Assigned by Nozomi

CVE-2025-11678Stack-based Buffer Overflow in libwebsockets DNS response parsing

High 7.5

In plain English

A high-severity stack buffer overflow in libwebsocket from warmcat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.5High

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	libwebsockets	no fix listed	DEBIAN-CVE-2025-11678
Debian:13	libwebsockets	4.3.5-1+deb13u1	DEBIAN-CVE-2025-11678
Debian:14	libwebsockets	4.3.5-3	DEBIAN-CVE-2025-11678
Ubuntu:22.04:LTS	libwebsockets	4.0.20-2ubuntu1.1	USN-8024-1
Ubuntu:22.04:LTS	libwebsockets	4.0.20-2ubuntu1.1	UBUNTU-CVE-2025-11678
Ubuntu:25.10	libwebsockets	no fix listed	UBUNTU-CVE-2025-11678

Affected products (as reported)

Vendor	Product	Versions
warmcat	libwebsocket	4.0 – through 4.4.24.0 – through 4.3.6

Weakness: CWE-121 · Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://libwebsockets.org/git/libwebsockets/commit?id=2bb9598562b37c942ba5b04bcde3f7fdf66a9d3a patch, vendor-advisory
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11678 third-party-advisory