# CVE-2026-19773

Unauthenticated HTTP/2 HPACK parsing RCE in libwebsockets (CVE-2026-19773)

- Page: https://www.vulneraibility.com/cve/CVE-2026-19773
- CVSS: 9.8
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.65% (percentile 51.0)
- CISA SSVC: exploitation none, automatable yes, technical impact total (assessed 2026-09-15)
- Weakness: CWE-787
- Published: 2026-09-15

## Affected versions

- libwebsockets: affected b4b5aed3903eaff09cd76a410f69bbe5dff66f8e

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote unauthenticated out‑of‑bounds write in HTTP/2 HPACK path parsing enabling arbitrary code execution in the process.

## Action

Immediate action required

## Recommendation

Upgrade to the patched libwebsockets release or apply the upstream commit; if not possible, disable HTTP/2 and restrict access.

## References

- [advisory] https://www.zerodayinitiative.com/advisories/ZDI-26-590/
- [advisory] https://github.com/warmcat/libwebsockets/commit/824151862f37bc72f46d9a3e01d5b9408d313a0b

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.