CVE-2026-10650 is a medium severity resource consumption vulnerability in warmcat libwebsockets versions 4.5.0 through 4.5.8. The vulnerability resides in the SSH Protocol Handler's lws_ssh_parse_plaintext function, where an attacker can manipulate the msg_len argument to trigger excessive resource consumption remotely without any privileges or user interaction. Although a patch commit (3f9f0c6ecaf0e6f3f219d30632c5d1f2479d7498) has been identified, there is no explicit vendor advisory or official remediation level provided. Exploit code has been published, increasing the risk of exploitation.

Successful exploitation can lead to resource exhaustion on the affected system, potentially degrading service availability or causing denial of service. The vulnerability can be triggered remotely without authentication or user interaction, increasing the attack surface. No direct code execution or data compromise is indicated.

A patch commit addressing this vulnerability has been identified; applying the corresponding patch is recommended once available. Since no official vendor advisory or remediation level is provided, users should monitor the vendor's channels for an official fix. Until patched, consider limiting exposure of the SSH Protocol Handler component to untrusted networks to reduce risk.