A buffer overflow occurs in the LEJP JSON parser of libwebsockets. The overflow is triggered by a specially crafted JSON payload processed in the main branch at commit 106d542c. When an attacker sends such a payload, an exception causes the library to crash, resulting in a denial of service but no code execution.

Any deployment of libwebsockets that contains the vulnerable commit 106d542c. The library is widely used in WebSocket implementations; vendor packaging is not specified, so any application that links to libwebsockets must verify its version against that commit hash.

The flaw can be exploited remotely by sending a malformed JSON request over HTTP or WebSocket to a vulnerable instance. The CVSS score of 7.5 reflects high severity on availability, while the EPSS score of <1% indicates a low likelihood of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. Attackers need only the ability to send requests to the target; no privileged access or code execution is required, and the impact is limited to service disruption.