Quick answers
- Is CVE-2026-87045 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-87045 being exploited in the wild.
- How severe is CVE-2026-87045?
- High severity, with a CVSS score of 7.5, published 6 November 2026.
- Which products and versions are affected?
- Zephyr RTOS versions with CONFIG_HTTP_SERVER and HTTP/2 enabled.
- Is there a fix for CVE-2026-87045?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-87045 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2026-87045?
- Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in http_server_http2.c where handle_http_frame_header() unconditionally clears client->current_stream to NULL, but enter_http_frame_continuation_state() fails to re-bind it for CONTINUATION frames, leaving it NULL during header processing. Two code paths then dereference the NULL pointer: send_http2_404()/send_http2_405() when handling 404/405 responses, and handle_http2_dynamic_resource() when processing POST/PUT/PATCH requests. A legitimate peer with network access can trigger this without authentication by sending a CONTINUATION frame with END_HEADERS after the client preface, or by splitting a header block across frames.
Affected products
- Zephyr Zephyr RTOS versions with CONFIG_HTTP_SERVER and HTTP/2 enabled
Timeline
- 2026-11-06: disclosed