CVE-2026-82391

9.1 CRITICALpublic exploit available

Published 2026-11-10 · Updated 2026-11-10

AI risk analysis

Summary: The Zephyr HTTP/2 server incorrectly reused the per-connection receive buffer's remaining byte count (data_len) as a file size when serving static files, allowing unauthenticated attackers to cause heap or stack buffer overflows by sending specially crafted HTTP/2 frames that exceed the fixed buffer size. This occurs because data_len is overwritten with the on-disk file size and never reset, corrupting frame parsing state and enabling arbitrary memory writes.
Exploitability: Exploitation is straightforward for unauthenticated remote attackers on networks where HTTP/2 is enabled with static filesystem resources configured, requiring only a single malformed GET request to trigger the buffer overflow condition.
Blast radius: Successful exploitation could lead to full remote code execution or denial of service in embedded ICS, IoT, or edge devices running Zephyr with the vulnerable HTTP server configuration, potentially compromising critical infrastructure.
Detection: Defenders should monitor for HTTP/2 frames with abnormally large length fields exceeding the configured buffer size (e.g., >256 bytes) in network traffic logs, or unexpected crashes/restarts of the HTTP server process coinciding with static file requests. No reliable host-side log or artifact is documented in the CVE description.
Prioritized remediation: Upgrade to Zephyr 3.7.0 or later, where the issue is fixed by ensuring client->data_len is reset after serving static files and by validating file_size against buffer capacity before overwriting it.

buffer-overflowhttp2rceioticsauth-bypass

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client->buffer[CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE] (256 bytes by default), an invariant every frame handler and the socket receive path rely on. Serving any static file therefore replaced that bounded value with the file's on-disk size, and nothing resets it afterwards. The defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, in applications that register a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y; CONFIG_HTTP_SERVER_VERSION_2 is enabled by default and no TLS or credentials are required on this path. Once client->data_len exceeds the buffer size, the frame dispatch loop in subsys/net/lib/http/http_server_core.c keeps parsing past the end of the received data, and the peer controls the bytes at client->cursor, so it can choose which fabricated frame the state machine consumes next by appending bytes after its request. The inflated length defeats the only guards on the buffer. parse_http_frame_header() and the per-frame handlers read and skip up to a 24-bit frame length beyond the buffer (out-of-bounds read); the compaction memmove(client->buffer, client->cursor, client->data_len) at the end of request handling copies the file-size number of bytes into the 256-byte buffer, overflowing the rest of struct http_client_ctx — including the current_detail/current_stream pointers, the parser_settings function-pointer table and the inactivity_timer work handler — and the adjacent client contexts in static memory; and the subsequent zsock_recv(client->fd, client->buffer + client->data_len, sizeof(client->buffer) - client->data_len, 0) underflows its size argument, writing attacker-supplied data of attacker-chosen length out of bounds. The impact is remote memory corruption in the server's single address space: at minimum a crash or hang of the device, and plausibly control-data overwrite leading to code execution. The HTTP/1 and HTTP/3 static-filesystem handlers already used a local variable and are unaffected; the fix makes the HTTP/2 handler use a local size_t file_size as well.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Weaknesses

CWE-787

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.