Hi,

The following vulnerabilities were published for libwebsockets.

CVE-2026-95114[0]:
| libwebsockets contains an out-of-bounds read vulnerability in the
| LEJP incremental parser in lib/misc/lejp.c. This allows a remote
| attacker to cause a denial of service

https://github.com/warmcat/libwebsockets/issues/3664
https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a

CVE-2026-95115[1]:
| Buffer Overflow vulnerability in libwebsockets main 106d542c allows
| a remote attacker to cause a denial of service via the LEJP JSON
| parser

https://github.com/warmcat/libwebsockets/issues/3663
https://github.com/warmcat/libwebsockets/commit/c404a205a98323a7f60e69fae532c5d26bf4a62a


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-95114
https://www.cve.org/CVERecord?id=CVE-2026-95114
[1] https://security-tracker.debian.org/tracker/CVE-2026-95115
https://www.cve.org/CVERecord?id=CVE-2026-95115

Please adjust the affected versions in the BTS as needed.