# CVE-2026-5067: Zephyr RTOS stack overflow in HTTP server WebSocket upgrade

Source: https://junglewise.ai/threats/cve-2026-5067-zephyr-rtos-stack-overflow-in-http-server-websocket-upgrade  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-5067 · Severity: critical · CVSS 9.8 · Published 2026-06-09

A vulnerability exists in the Zephyr real-time operating system's HTTP server when handling WebSocket connections. An unauthenticated attacker can send a specially crafted network request to crash the device or potentially take control of it. This affects embedded devices and IoT hardware using Zephyr that have WebSocket support enabled, potentially leading to service outages or unauthorized data access.

Technologies: [Zephyr Project Zephyr](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-5067 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5067 being exploited in the wild.

**How severe is CVE-2026-5067?** Critical severity, with a CVSS score of 9.8, published 9 June 2026.

**Which products and versions are affected?** Zephyr Project Zephyr >= 3.7.0, <= 4.3.0.

**Is there a fix for CVE-2026-5067?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-5067 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-5067?** Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based out-of-bounds read and write vulnerability exists in Zephyr's HTTP/1.1 server during WebSocket upgrade handling. The root cause is an improper null termination (CWE-170) in the header parser; when a 32-byte 'Sec-WebSocket-Key' is received, it is copied into a fixed-size buffer without a guaranteed NUL terminator. Subsequent processing in 'http_server_ws.c' copies this data to a local stack buffer and calls 'strlen()', which reads past the buffer bounds. This leads to an out-of-bounds write when the server attempts to concatenate the WebSocket magic string. An unauthenticated remote attacker can exploit this to cause a denial of service (crash) or achieve remote code execution. The vulnerability is reachable only when CONFIG_HTTP_SERVER_WEBSOCKET is enabled.

## Affected products

- Zephyr Project Zephyr RTOS >= 3.7.0, <= 4.3.0

## Timeline

- 2026-05-23: other: Embargo date
- 2026-06-09: disclosed: Initial publication date
- 2026-06-09: advisory

## References

- [https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wgr4-9pwq-94vj](https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wgr4-9pwq-94vj)

## Related threats

- [Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api)
- [Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port)
- [Zephyr HTTP server HTTP/2 buffer overflow via static file serving](https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection)
- [Zephyr OpenThread hardcoded default joiner credential](https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner)
- [Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids)