Debian DSA-6529-1 Updates libwebsockets for Security Vulnerabilities
Tech GuruQuick Answer
DSA-6529-1 fixes CVE-2026-19773 in Debian 13 (trixie)'s libwebsockets packages at source build 4.3.5-1+deb13u3. The defect is missing input validation in an HPACK path-header parser, with denial of service or possible code execution. Identify the application loading the library instead of assuming every WebSocket service uses this implementation.
Confirm Scope And Apply The Supported Fix
What to do now: update installed Debian binary packages built from the fixed libwebsockets source and replace long-running consumers of the old library. Assess bundled/static copies separately. Preserve service configuration and test the application's actual request or connection path after maintenance.
Last verified: October 2, 2026 UTC against the Debian announcement. No service or parser was tested.
Scope And Authority
| Product scope | Debian 13 (trixie) libwebsockets packages |
|---|---|
| Advisory | DSA-6529-1 |
| CVE | CVE-2026-19773 |
| Authoritative release date | 2026-09-29 20:36:04 UTC (Date header of Debian announcement) |
| Authority revision date | No separate material revision date stated by Debian when verified |
| Affected versions | Debian 13 (trixie) libwebsockets packages before 4.3.5-1+deb13u3. |
| Fixed version | libwebsockets 4.3.5-1+deb13u3 for Debian 13 (trixie) |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | Not stated by the authority; no exploitation claim is inferred. |
What Changed
The advisory identifies HPACK path-header parsing, not a generic flaw in every WebSocket connection. A reverse proxy and its backend may use different protocol/library paths, so identify where libwebsockets actually parses input before deciding which process must change.
What To Validate Now
- Find the consumer. Match each service to its loaded Debian libwebsockets binary package, deployment image or embedded build. Record externally reachable input paths without sending malformed traffic.
- Apply the trixie fix. Update the matching installed library packages to the build from
4.3.5-1+deb13u3. Use the application supplier's process for a bundled/static copy rather than assuming the host package transaction replaces it. - Replace old processes. Restart affected services through the approved maintenance procedure and verify the resulting package/deployment identity.
- Exercise normal traffic. Test the required request/connection path through any proxy and backend, checking expected responses and logs. A proxy health check alone may not exercise the consumer.
- Retain scope and gaps. Keep service-to-library mapping, update evidence and results; a reachable endpoint is not evidence that it has been exploited.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
