Memory Corruption Vulnerability in Zephyr HTTP Server WebSocket Upgrade Path

CVE-2026-5067

What is CVE-2026-5067?

A vulnerability in Zephyr's HTTP server allows an unauthenticated attacker to exploit a flaw in the WebSocket upgrade handling. By sending a specially crafted Sec-WebSocket-Key header, the attacker can cause memory corruption through improper handling of the HTTP/1 header parser. This occurs as the parser fails to ensure NUL termination when copying data into a fixed-size buffer, leading to an out-of-bounds read and write. This could trigger a denial of service or potentially allow for remote code execution, particularly if the CONFIG_HTTP_SERVER_WEBSOCKET option is enabled.

References