CVE-2025-11678

Publication date 20 October 2025

Last updated 12 February 2026

Ubuntu priority

Description

Stack-based Buffer Overflow in lws_adns_parse_label in warmcat libwebsockets allows, when the LWS_WITH_SYS_ASYNC_DNS flag is enabled during compilation, to overflow the label_stack, when the attacker is able to sniff a DNS request in order to craft a response with a matching id containing a label longer than the maximum.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
libwebsockets	25.10 questing	Vulnerable
	25.04 plucky	Ignored end of life, was needs-triage
	24.04 LTS noble	Fixed 4.3.3-1.1ubuntu0.1~esm1
	22.04 LTS jammy	Fixed 4.0.20-2ubuntu1.1
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected

Get expanded security coverage with Ubuntu Pro

Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.

CVE-2025-11678

Description

Status

Get expanded security coverage with Ubuntu Pro

References

Related Ubuntu Security Notices (USN)

Other references