HTTP/2 Server Vulnerability in Zephyr Project's Network Stack

CVE-2026-87045

What is CVE-2026-87045?

The HTTP/2 server implementation in the Zephyr Project's network stack is susceptible to a denial of service due to improper handling of CONTINUATION frames. A malicious actor can exploit this vulnerability by sending a CONTINUATION frame that is not preceded by a HEADERS frame. This oversight allows the processing of HTTP requests to proceed with an unset current stream, leading to system faults and crashes. The vulnerability is remotely triggerable, requiring no authentication, which means any reachable peer can initiate an attack. This poses a significant risk to devices with the HTTP/2 server enabled, as the attack does not rely on manipulative payloads but rather exploits the server’s handling of frame sequences.

References