Heap and Stack Buffer Overflow in CivetWeb by Normand Poirier
CVE-2026-29035

8.3HIGH

Key Information:

Vendor

Civetweb

Status
Civetweb
Vendor
CVE Published:
11 August 2026

What is CVE-2026-29035?

CivetWeb has a vulnerability in its read_websocket() function that allows unauthenticated remote attackers to exploit heap and stack buffer overflows. When both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES macros are enabled, attackers can craft compressed WebSocket frames that, when sent during the WebSocket handshake, trigger a malfunction. This includes negotiating permessage-deflate and setting the RSV1 bit, leading the server to mistakenly write a 4-byte zlib sync trailer beyond its allocated buffer. The resulting memory corruption could cause denial of service or potential code execution vulnerabilities.

Affected Version(s)

civetweb 0 <= 4a4f0c95

References

https://github.com/civetweb/civetweb
product
https://www.vulncheck.com/advisories/civetweb-heap-stack-...
third-party-advisory

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kazuma Matsumoto, a security researcher at GMO Cybersecurity by IERAE, Inc.
.