# CVE-2026-87045: Zephyr HTTP/2 server NULL pointer dereference in stream binding

Source: https://junglewise.ai/threats/cve-2026-87045-the-http-2-server-in-subsys-net-lib-http-http-server-http2-c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-87045 · Severity: high · CVSS 7.5 · Published 2026-11-06

The HTTP/2 server in Zephyr RTOS improperly clears stream state at the start of every frame, causing a NULL pointer dereference when processing CONTINUATION frames without a preceding HEADERS frame. An unauthenticated remote attacker can crash the device by sending a malformed HTTP/2 frame sequence, resulting in immediate denial of service.

Technologies: [Zephyr RTOS](https://junglewise.ai/threats/technologies/rtos). Vendors: [Zephyr](https://junglewise.ai/threats/vendors/zephyr).

## Quick answers

**Is CVE-2026-87045 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87045 being exploited in the wild.

**How severe is CVE-2026-87045?** High severity, with a CVSS score of 7.5, published 6 November 2026.

**Which products and versions are affected?** Zephyr RTOS versions with CONFIG_HTTP_SERVER and HTTP/2 enabled.

**Is there a fix for CVE-2026-87045?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-87045 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-87045?** Check whether you run Zephyr RTOS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in http_server_http2.c where handle_http_frame_header() unconditionally clears client->current_stream to NULL, but enter_http_frame_continuation_state() fails to re-bind it for CONTINUATION frames, leaving it NULL during header processing. Two code paths then dereference the NULL pointer: send_http2_404()/send_http2_405() when handling 404/405 responses, and handle_http2_dynamic_resource() when processing POST/PUT/PATCH requests. A legitimate peer with network access can trigger this without authentication by sending a CONTINUATION frame with END_HEADERS after the client preface, or by splitting a header block across frames.

## Affected products

- Zephyr Zephyr RTOS versions with CONFIG_HTTP_SERVER and HTTP/2 enabled

## Timeline

- 2026-11-06: disclosed

## Related threats

- [Zephyr RFCOMM multiplexer buffer overflow and information disclosure](https://junglewise.ai/threats/cve-2026-77685-the-rfcomm-multiplexer-control-channel-handler-in-subsys)
- [Xtensa MMU uninitialized page-table pointer in userspace thread setup](https://junglewise.ai/threats/cve-2026-90586-the-xtensa-mmu-userspace-port-never-initialized-the-per-thread)
- [Zephyr RTIO submission-queue verifier memory access bypass](https://junglewise.ai/threats/cve-2026-87041-the-rtio-submission-queue-verifier-rtio-vrfy-sqe-in-subsys-rtio)
- [Zephyr i3c_transfer TOCTOU privilege escalation](https://junglewise.ai/threats/cve-2026-87038-the-user-mode-verification-handler-for-the-i3c-transfer-system)
- [Zephyr Bluetooth Classic AVDTP memory corruption in work queue](https://junglewise.ai/threats/cve-2026-85036-the-bluetooth-classic-avdtp-layer-defers-releasing-a-session-s)