CVE-2025-11677

Published: October 23, 2025Last modified: June 22, 2026

Description

Use After Free in WebSocket server implementation in lws_handshake_server in warmcat libwebsockets may allow an attacker, in specific configurations where the user provides a callback function that handles LWS_CALLBACK_HTTP_CONFIRM_UPGRADE, to achieve denial of service.

Status

Product	Release	Package	Status
Alpaquita Linux	23 LTS	libwebsockets	Fixed (4.3.10-r0)
	25 LTS	libwebsockets	Fixed (4.3.10-r0)
	Stream	libwebsockets	Fixed (4.3.10-r0)

References

https://libwebsockets.org/git/libwebsockets/commit?id=2f082ec31261f556969160143ba94875d783971a
https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2025-11677

How to Fix Liberica NIK Not Starting on macOS Catalina and Later

If you use macOS Catalina and later you may encounter the issue that prevents Liberica NIK from starting. To fix it, run the following:

sudo xattr -r -d com.apple.quarantine path/to/graalvm/folder/

If you need more help, check out the FAQ at the bottom of this page or contact us.