HTTP Client Vulnerability in Zephyr Project Affects Application Integrity

CVE-2026-90588

What is CVE-2026-90588?

A vulnerability in the HTTP client's debug helper print_header_field() allows for a buffer over-read due to improperly formatted data. The issue arises from the way the HTTP parser handles callback slices, leading to potential faults and panics in devices when dealing with malicious or compromised server responses. Although default builds remain unaffected due to logging settings, the root cause can still create security concerns that require swift remediation.

References