CVE-2026-114550: libwebsockets MQTT PUBACK Out-of-Bounds Write — Detection and Mitigation Guide

---
title: MQTT PUBACK Flood or Anomalous Packet Detection
id: 3f8a9c2e-7b1d-4e5f-9a8c-2d4e6f8a1b3c
status: experimental
description: Detects high volume of MQTT PUBACK packets or oversized PUBACK messages potentially indicating exploitation attempts against CVE-2026-114550
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-792/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
  product: zeek
detection:
  selection:
    id.resp_p: [1883, 8883]
    mqtt.msg_type: 'PUBACK'
  condition: selection
falsepositives:
  - High-volume legitimate MQTT QoS 1 traffic during bulk message processing
level: medium
---
title: libwebsockets Process Crash and Restart
id: 7b2c4d6e-9f1a-3b5c-8d2e-4f6a8c1e3b5d
status: experimental
description: Detects abnormal termination and restart of libwebsockets processes, potentially indicating failed exploitation of CVE-2026-114550 causing segmentation faults
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-792/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.defense_evasion
  - attack.t1036
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|contains: 'libwebsockets'
  condition: selection
falsepositives:
  - Normal service restarts
  - Container orchestration health checks
level: low
---
title: libwebsockets Spawning Suspicious Child Processes
id: 9d4e6f8a-1c3b-5d7e-9f2a-4c6e8a1c3e5f
status: experimental
description: Detects libwebsockets processes spawning command shells or scripting engines, indicative of successful remote code execution following CVE-2026-114550 exploitation
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-792/
author: Security Arsenal
date: 2026/01/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: 'libwebsockets'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
      - '/curl'
      - '/wget'
  condition: selection
falsepositives:
  - Legitimate administrative scripts initiated by the application
level: high

// Hunt for suspicious child processes spawned by libwebsockets
// Requires process command-line auditing via Sysmon for Linux, auditd, or MDE
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName contains "libwebsockets"
| where FileName in ("sh", "bash", "dash", "zsh", "python", "perl", "curl", "wget", "nc", "netcat", "powershell")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| order by TimeGenerated desc

-- Hunt for libwebsockets processes with suspicious child processes or network connections
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'libwebsockets'
   OR Exe =~ 'libwebsockets'

// Additionally hunt for established outbound connections from these processes
SELECT Pid, Name, RemoteAddress, RemotePort, State
FROM netstat()
WHERE Name =~ 'libwebsockets'
   AND State == 'ESTABLISHED'

#!/bin/bash
# CVE-2026-114550 Verification and Hardening Script
# Run with root privileges

echo "[+] Checking for libwebsockets installation and version"

# Check for libwebsockets shared library presence
LIB_PATH=$(ldconfig -p | grep libwebsockets | head -1 | awk '{print $NF}')
if [ -n "$LIB_PATH" ]; then
    echo "[!] libwebsockets library found at: $LIB_PATH"
    # Extract version if possible
    if [ -f "$LIB_PATH" ]; then
        VERSION=$(strings "$LIB_PATH" | grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' | head -1)
        echo "[!] Detected version: ${VERSION:-Unknown}"
        echo "[!] IMMEDIATE ACTION REQUIRED: Update to patched version or recompile from fixed source"
    fi
else
    echo "[+] libwebsockets shared library not found in ldconfig cache"
fi

# Check for statically linked binaries (common in embedded/IoT)
echo "[+] Checking for statically linked libwebsockets in running processes"
ps aux | grep -i mqtt | grep -v grep | while read -r line; do
    echo "[!] MQTT-related process detected: $line"
    echo "    Review process for libwebsockets linkage (lsof or /proc/<pid>/maps)"
done

# Network exposure check
echo "[+] Checking for MQTT service exposure (ports 1883, 8883)"
if netstat -tuln 2>/dev/null | grep -E ':(1883|8883)' > /dev/null || ss -tuln 2>/dev/null | grep -E ':(1883|8883)' > /dev/null; then
    echo "[!] MQTT ports detected as listening"
    echo "[!] Recommend immediate network segmentation or ACL restriction until patch is applied"
    
    # Optional: Implement temporary iptables rate limiting
    echo "[+] To implement temporary rate limiting, run:"
    echo "    iptables -A INPUT -p tcp --dport 1883 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT"
    echo "    iptables -A INPUT -p tcp --dport 1883 -j DROP"
else
    echo "[+] No MQTT services detected on standard ports"
fi

echo "[+] Hardening recommendations:"
echo "    1. Compile libwebsockets with -D_LWS_WITH_MINIMAL_EXAMPLES=0 to remove unnecessary protocol handlers"
echo "    2. Disable MQTT support entirely if not required (-DLWS_WITH_MQTT=OFF)"
echo "    3. Implement network segmentation to restrict MQTT traffic to trusted subnets"
echo "    4. Monitor for libwebsockets process crashes and child process spawning"