PT-2026-47689 · Zephyr · Zephyr
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Zephyr (affected versions not specified)
Description
A remote, unauthenticated attacker can cause memory corruption in the HTTP server WebSocket upgrade path. The issue occurs because the HTTP/1 header parser uses a bounded copy to move the
Sec-WebSocket-Key header into a fixed-size buffer without guaranteeing NUL termination when the input length equals the buffer size. During the upgrade process, this buffer is copied to a local stack buffer and processed by the strlen() function. If no NUL terminator is present, strlen() reads beyond the stack buffer, and the subsequent concatenation with the WebSocket magic string results in an out-of-bounds write. This leads to out-of-bounds read and write operations on stack memory, which can cause a system crash (denial of service) or potentially allow arbitrary code execution. This path is accessible when CONFIG HTTP SERVER WEBSOCKET is enabled.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
As a temporary workaround, disable the
CONFIG HTTP SERVER WEBSOCKET configuration to minimize the risk of exploitation.Exploit
DoS
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Zephyr