{"schema_version":1,"title":"Zephyrproject Zephyr vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in Zephyrproject Zephyr: 0 in the last 7 days and 0 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-11368, was published on 4 August 2026.","url":"https://junglewise.ai/threats/technologies/zephyrproject-zephyr","json_url":"https://junglewise.ai/threats/technologies/zephyrproject-zephyr.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/zephyrproject-zephyr","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":true,"counts":{"high":3,"all_time":8,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":0,"last_365_days":6},"latest":[{"cve":"CVE-2026-11368","cvss":7.1,"epss":0.003,"slug":"cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c","title":"The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning…","severity":"high","exploited":false,"published_at":"2026-08-04T15:16:24.843+00:00","url":"https://junglewise.ai/threats/cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c"},{"cve":"CVE-2026-10849","cvss":8.2,"epss":0.0051,"slug":"cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit","title":"The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update…","severity":"high","exploited":false,"published_at":"2026-08-03T22:16:47.963+00:00","url":"https://junglewise.ai/threats/cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit"},{"cve":"CVE-2026-2411","cvss":6.5,"epss":0.0018,"slug":"cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two","title":"Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration…","severity":"medium","exploited":false,"published_at":"2026-08-01T13:16:57.16+00:00","url":"https://junglewise.ai/threats/cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two"},{"cve":"CVE-2026-10773","cvss":5.4,"epss":0.0027,"slug":"cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net","title":"The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const…","severity":"medium","exploited":false,"published_at":"2026-08-01T13:16:56.987+00:00","url":"https://junglewise.ai/threats/cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net"},{"cve":"CVE-2026-1679","cvss":7.3,"epss":0.0022,"slug":"cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads","title":"The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space…","severity":"high","exploited":false,"published_at":"2026-03-28T00:16:04.74+00:00","url":"https://junglewise.ai/threats/cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads"},{"cve":"CVE-2026-1678","cvss":9.4,"epss":0.0044,"slug":"cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it","title":"dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the…","severity":"critical","exploited":false,"published_at":"2026-03-05T07:16:11.437+00:00","url":"https://junglewise.ai/threats/cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it"},{"cve":"CVE-2025-20747","cvss":6.7,"epss":0.0009,"slug":"cve-2025-20747-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an","title":"In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…","severity":"medium","exploited":false,"published_at":"2025-11-04T07:15:49.54+00:00","url":"https://junglewise.ai/threats/cve-2025-20747-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an"},{"cve":"CVE-2025-20746","cvss":6.7,"epss":0.0009,"slug":"cve-2025-20746-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an","title":"In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…","severity":"medium","exploited":false,"published_at":"2025-11-04T07:15:48.7+00:00","url":"https://junglewise.ai/threats/cve-2025-20746-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Zephyrproject Zephyr","slug":"zephyrproject-zephyr","vendor":{"hub":true,"name":"Zephyrproject","slug":"zephyrproject","url":"https://junglewise.ai/threats/vendors/zephyrproject"},"aliases":[],"homepage":"https://www.zephyrproject.org/","description":"Scalable real-time operating system for IoT and resource-constrained embedded devices.","url":"https://junglewise.ai/threats/technologies/zephyrproject-zephyr"},"most_severe":[{"cve":"CVE-2026-1678","cvss":9.4,"epss":0.0044,"slug":"cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it","title":"dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the…","severity":"critical","exploited":false,"published_at":"2026-03-05T07:16:11.437+00:00","url":"https://junglewise.ai/threats/cve-2026-1678-dns-unpack-name-caches-the-buffer-tailroom-once-and-reuses-it"},{"cve":"CVE-2026-10849","cvss":8.2,"epss":0.0051,"slug":"cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit","title":"The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update…","severity":"high","exploited":false,"published_at":"2026-08-03T22:16:47.963+00:00","url":"https://junglewise.ai/threats/cve-2026-10849-the-hawkbit-device-management-client-in-subsys-mgmt-hawkbit"},{"cve":"CVE-2026-1679","cvss":7.3,"epss":0.0022,"slug":"cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads","title":"The eswifi socket offload driver copies user-provided payloads into a fixed buffer without checking available space…","severity":"high","exploited":false,"published_at":"2026-03-28T00:16:04.74+00:00","url":"https://junglewise.ai/threats/cve-2026-1679-the-eswifi-socket-offload-driver-copies-user-provided-payloads"},{"cve":"CVE-2026-11368","cvss":7.1,"epss":0.003,"slug":"cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c","title":"The Bluetooth host ATT layer (subsys/bluetooth/host/att.c) associates each in-flight ATT TX buffer with its owning…","severity":"high","exploited":false,"published_at":"2026-08-04T15:16:24.843+00:00","url":"https://junglewise.ai/threats/cve-2026-11368-the-bluetooth-host-att-layer-subsys-bluetooth-host-att-c"},{"cve":"CVE-2025-20747","cvss":6.7,"epss":0.0009,"slug":"cve-2025-20747-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an","title":"In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…","severity":"medium","exploited":false,"published_at":"2025-11-04T07:15:49.54+00:00","url":"https://junglewise.ai/threats/cve-2025-20747-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an"},{"cve":"CVE-2025-20746","cvss":6.7,"epss":0.0009,"slug":"cve-2025-20746-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an","title":"In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local…","severity":"medium","exploited":false,"published_at":"2025-11-04T07:15:48.7+00:00","url":"https://junglewise.ai/threats/cve-2025-20746-in-gnss-service-there-is-a-possible-out-of-bounds-write-due-to-an"},{"cve":"CVE-2026-2411","cvss":6.5,"epss":0.0018,"slug":"cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two","title":"Zephyr's Bluetooth host declares a GATT characteristic as two consecutive attributes: a Characteristic Declaration…","severity":"medium","exploited":false,"published_at":"2026-08-01T13:16:57.16+00:00","url":"https://junglewise.ai/threats/cve-2026-2411-zephyr-s-bluetooth-host-declares-a-gatt-characteristic-as-two"},{"cve":"CVE-2026-10773","cvss":5.4,"epss":0.0027,"slug":"cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net","title":"The DHCPv4 client helper net_dhcpv4_msg_type_name() in subsys/net/lib/dhcpv4/dhcpv4.c indexes a static 8-element const…","severity":"medium","exploited":false,"published_at":"2026-08-01T13:16:56.987+00:00","url":"https://junglewise.ai/threats/cve-2026-10773-the-dhcpv4-client-helper-net-dhcpv4-msg-type-name-in-subsys-net"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}