# CVE-2026-82391: Zephyr HTTP server HTTP/2 buffer overflow via static file serving

Source: https://junglewise.ai/threats/cve-2026-82391-the-http-2-front-end-of-the-zephyr-http-server-aliased-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-82391 · Severity: critical · CVSS 9.1 · Published 2026-11-10

Zephyr is an open-source real-time operating system used in embedded devices and IoT applications. An unauthenticated attacker can trigger a memory corruption vulnerability in the HTTP/2 server by requesting a static file, allowing them to crash the device or potentially execute arbitrary code on the system.

Technologies: [Zephyr Project Zephyr](https://junglewise.ai/threats/technologies/zephyr). Vendors: [Zephyr Project](https://junglewise.ai/threats/vendors/zephyr-project).

## Quick answers

**Is CVE-2026-82391 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82391 being exploited in the wild.

**How severe is CVE-2026-82391?** Critical severity, with a CVSS score of 9.1, published 10 November 2026.

**Which products and versions are affected?** Zephyr Project Zephyr versions with CONFIG_HTTP_SERVER_VERSION_2 enabled (default) and CONFIG_FILE_SYSTEM=y and HTTP_RESOURCE_TYPE_STATIC_FS registered.

**Is there a fix for CVE-2026-82391?** Yes: fixed in Fixed in subsys/net/lib/http/http_server_http2.c by using a local size_t variable for file_size instead of aliasing client->data_len. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82391 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-82391?** Check whether you run Zephyr Project Zephyr at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Fixed in subsys/net/lib/http/http_server_http2.c by using a local size_t variable for file_size instead of aliasing client->data_len

## Technical details

The HTTP/2 handler in Zephyr's HTTP server passes a connection's receive buffer length variable to be overwritten with the requested file's on-disk size. Once this variable exceeds the 256-byte buffer, subsequent frame parsing reads past the buffer boundary and a memmove operation during request handling overflows the buffer, corrupting adjacent control structures and other client contexts in static memory. An unauthenticated network attacker can trigger this by sending an HTTP/2 GET request for any file in the configured web root when static filesystem resources are enabled.

## Affected products

- Zephyr Project Zephyr versions with CONFIG_HTTP_SERVER_VERSION_2 enabled (default) and CONFIG_FILE_SYSTEM=y and HTTP_RESOURCE_TYPE_STATIC_FS registered

## Timeline

- 2026-11-10: disclosed

## Related threats

- [Zephyr UART wide-data syscall verifier NULL pointer dereference](https://junglewise.ai/threats/cve-2026-90834-the-user-mode-syscall-verifiers-for-the-16-bit-wide-data-uart-api)
- [Zephyr PTP port unvalidated logMessageInterval denial of service](https://junglewise.ai/threats/cve-2026-87042-the-ieee-1588-ptp-port-implementation-in-subsys-net-lib-ptp-port)
- [Zephyr OpenThread hardcoded default joiner credential](https://junglewise.ai/threats/cve-2026-19741-zephyr-s-openthread-integration-defined-config-openthread-joiner)
- [Zephyr ARM64 MMU ASID allocation collision in memory domain isolation](https://junglewise.ai/threats/cve-2026-19574-the-arm64-mmu-back-end-allocated-address-space-identifiers-asids)
- [Zephyr kernel integer overflow in dynamic object allocation](https://junglewise.ai/threats/cve-2026-19569-dynamic-object-create-in-kernel-userspace-userspace-c-computed)