An out‑of‑bounds read in the LEJP incremental parser of libwebsockets (CWE‑125) allows a remote attacker to send a crafted WebSocket message that causes the library to crash and the hosting application to become unavailable. The failure mode is a service disruption and does not directly compromise confidentiality or integrity.

Any application that links against libwebsockets and uses its LEJP parser for WebSocket processing is affected, such as servers or services that provide WebSocket endpoints. Versions of libwebsockets compiled before the changes in commits 736a4a26 and c404a205 are not patched; any release built after those commits is considered fixed.

The CVSS score of 7.5 indicates a high severity denial‑of‑service risk. The EPSS score of < 1% shows a low current probability of exploitation. Based on the description, the vulnerability can be triggered over the network by an unauthenticated attacker sending a crafted WebSocket message to the endpoint; this is an inferred attack vector. The impact is a loss of availability until the application or process is restarted. The vulnerability is not listed in the CISA KEV catalog, but it remains a significant risk for services requiring high availability.