Heap use after free detected in libwebsockets wsi.c

[RubberDucky-ccc]

We have a linux application using libwebsockets with libuv, calling lws_cancel_service to interact with the service loop. While Debugging, we use address sanitizing to detect memory leaks because those could become security concerns for our use case.

Unfortunately, whenever i try to disconnect from the server i connect to over libwebsockets, i get a heap-use-after-free in libwebsockets/lib/core-net/wsi.c:510 (in user_callback_handle_rxflow).
The function is pretty simple so i think we can assume it's the wsi pointer which was previously freed. During our disconnect handling, we do destroy the lws context with the wsi, and our own ssl context.

I'm not really sure where to take the issue from here. Either we are doing something very wrong, or there is a use after free in libwebsockets, but i'm not ruling out the former.

[lws-team]

This rings a bell... there's a similar fix on _temp branch on libwebsockets.org

commit 3870f1a08281f5a37024eda11b870f715f01d3f2
Author: Andy Green <andy@warmcat.com>
Date:   Sat Mar 28 09:30:19 2026 +0000

    context destroy: avoid UAF

diff --git a/lib/core-net/vhost.c b/lib/core-net/vhost.c
index a4b3a9283..ed084235b 100644
--- a/lib/core-net/vhost.c
+++ b/lib/core-net/vhost.c
@@ -1449,6 +1449,7 @@ lws_vhost_destroy1(struct lws_vhost *vh)
 #endif
 
        vh->being_destroyed = 1;
+       vh->count_bound_wsi++; /* protect from opportunistic destroy */
        lws_dll2_add_tail(&vh->vh_being_destroyed_list,
                          &context->owner_vh_being_destroyed);
 
@@ -1536,6 +1537,7 @@ lws_vhost_destroy1(struct lws_vhost *vh)
        lws_sul_cancel(&vh->sul_unref);
 #endif
 
+       vh->count_bound_wsi--;
        lws_vhost_unlock(vh); /* } vh -------------- */
 
        for (n = 0; n < context->count_threads; n++)
@@ -1779,8 +1781,10 @@ lws_vhost_destroy(struct lws_vhost *vh)
        /* dispose of the listen socket one way or another */
        lws_vhost_destroy1(vh);
 
+       vh->count_bound_wsi++; /* protect from opportunistic destroy */
        /* start async closure of all wsi on this pt thread attached to vh */
        __lws_vhost_destroy_pt_wsi_dieback_start(vh);
+       vh->count_bound_wsi--;
 
        lwsl_vhost_info(vh, "count_bound_wsi %d", vh->count_bound_wsi);
 
diff --git a/lib/roles/pipe/ops-pipe.c b/lib/roles/pipe/ops-pipe.c
index ae13a56c8..15cf15b6d 100644
--- a/lib/roles/pipe/ops-pipe.c
+++ b/lib/roles/pipe/ops-pipe.c
@@ -164,9 +164,15 @@ rops_handle_POLLIN_pipe(struct lws_context_per_thread *pt, struct lws *wsi,
                                                 vh_being_destroyed_list);
 
                        lws_vhost_lock(v); /* -------------- vh { */
+                       v->count_bound_wsi++;
                        __lws_vhost_destroy_pt_wsi_dieback_start(v);
+                       v->count_bound_wsi--;
+                       int do_destroy2 = !v->count_bound_wsi && v->being_destroyed;
                        lws_vhost_unlock(v); /* } vh -------------- */
 
+                       if (do_destroy2)
+                               __lws_vhost_destroy2(v);
+
                } lws_end_foreach_dll_safe(d, d1);
        }