Executive brief
A vulnerability exists in the Zephyr real-time operating system's HTTP server when handling WebSocket connections. An unauthenticated attacker can send a specially crafted network request to crash the device or potentially take control of it. This affects embedded devices and IoT hardware using Zephyr that have WebSocket support enabled, potentially leading to service outages or unauthorized data access.
Technical details
A stack-based out-of-bounds read and write vulnerability exists in Zephyr's HTTP/1.1 server during WebSocket upgrade handling. The root cause is an improper null termination (CWE-170) in the header parser; when a 32-byte 'Sec-WebSocket-Key' is received, it is copied into a fixed-size buffer without a guaranteed NUL terminator. Subsequent processing in 'http_server_ws.c' copies this data to a local stack buffer and calls 'strlen()', which reads past the buffer bounds. This leads to an out-of-bounds write when the server attempts to concatenate the WebSocket magic string. An unauthenticated remote attacker can exploit this to cause a denial of service (crash) or achieve remote code execution. The vulnerability is reachable only when CONFIG_HTTP_SERVER_WEBSOCKET is enabled.
Affected products
- Zephyr Project Zephyr RTOS >= 3.7.0, <= 4.3.0
Timeline
- 2026-05-23: other: Embargo date
- 2026-06-09: disclosed: Initial publication date
- 2026-06-09: advisory