## Summary
libwebsockets contains a critical HTTP/2 HPACK parsing flaw in the handling of the HPACK “path header”, where insufficient bounds validation can lead to an out-of-bounds write and remote code execution without authentication.
## Technical Details
The issue is described as a write past the end of an allocated buffer caused by missing validation of user-supplied data during HTTP/2 HPACK path header parsing (CWE-787).
A vendor fix was committed in warmcat/libwebsockets commit 824151862f37bc72f46d9a3e01d5b9408d313a0b. The patch adds a bounds check before writing into the allocated header buffer:
- In treelib/roles/h2, within lws_frag_append(struct lws *wsi, unsigned char c), the code now checks ah->pos against wsi->a.context->max_http_header_data.
- If ah->pos is too large, the function returns 1 instead of writing to ah->data[ah->pos++].
This indicates the vulnerable behavior was an unchecked increment/write into ah->data and related fragment length tracking (ah->frags[ah->nfrag].len++).
## Affected
- libwebsockets (HTTP/2 HPACK path header parsing; fixed by commit 824151862f37bc72f46d9a3e01d5b9408d313a0b)
## Impact
- Remote attackers can execute arbitrary code in the context of the current process.
- Authentication is not required.
## Mitigation
1. Upgrade libwebsockets to a version that includes the fix from commit 824151862f37bc72f46d9a3e01d5b9408d313a0b.
2. If immediate upgrade is not possible, reduce exposure by limiting external access to services using HTTP/2 HPACK parsing.
3. Monitor for crashes or anomalous HTTP/2 traffic patterns targeting HPACK path header parsing endpoints/streams, and validate that the patched bounds check is present in lws_frag_append.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-787