{"id":"CVE-2026-82391","kind":"vulnerability","aliases":["CVE-2026-82391"],"related":[],"title":"Zephyr HTTP/2 server: static file request lets remote attackers corrupt memory","description":"The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client->buffer[CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE] (256 bytes by default), an invariant every frame handler and the socket receive path rely on. Serving any static file therefore replaced that bounded value with the file's on-disk size, and nothing resets it afterwards.\n\nThe defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, in applications that register a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y; CONFIG_HTTP_SERVER_VERSION_2 is enabled by default and no TLS or credentials are required on this path. Once client->data_len exceeds the buffer size, the frame dispatch loop in subsys/net/lib/http/http_server_core.c keeps parsing past the end of the received data, and the peer controls the bytes at client->cursor, so it can choose which fabricated frame the state machine consumes next by appending bytes after its request.\n\nThe inflated length defeats the only guards on the buffer. parse_http_frame_header() and the per-frame handlers read and skip up to a 24-bit frame length beyond the buffer (out-of-bounds read); the compaction memmove(client->buffer, client->cursor, client->data_len) at the end of request handling copies the file-size number of bytes into the 256-byte buffer, overflowing the rest of struct http_client_ctx — including the current_detail/current_stream pointers, the parser_settings function-pointer table and the inactivity_timer work handler — and the adjacent client contexts in static memory; and the subsequent zsock_recv(client->fd, client->buffer + client->data_len, sizeof(client->buffer) - client->data_len, 0) underflows its size argument, writing attacker-supplied data of attacker-chosen length out of bounds.\n\nThe impact is remote memory corruption in the server's single address space: at minimum a crash or hang of the device, and plausibly control-data overwrite leading to code execution. The HTTP/1 and HTTP/3 static-filesystem handlers already used a local variable and are unaffected; the fix makes the HTTP/2 handler use a local size_t file_size as well.","summary":"The HTTP/2 front end of the Zephyr HTTP server overwrites its own connection receive length with a static file's size when serving any file. That lets an unauthenticated remote client trigger out-of-bounds reads and writes and likely crash the device or run code.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"zephyr","fixed":["4.3.2","4.5.0"],"affected":">= 4.0.0, < 4.3.2; >= 4.4.0, < 4.5.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["embedded","http-server","http2","iot","runtime","zephyr"],"not_affected_if":["http1-or-http3-only","http2-disabled","no-static-fs"],"how_to_check":"1. Check your Zephyr version: affected are >= 4.0.0 and < 4.3.2, and >= 4.4.0 and < 4.5.0 (v3.7 is not affected).\n2. Check the build config for CONFIG_HTTP_SERVER=y, CONFIG_HTTP_SERVER_VERSION_2=y (default), and CONFIG_FILE_SYSTEM=y.\n3. Check whether the app registers an HTTP_RESOURCE_TYPE_STATIC_FS resource. If it does, a single HTTP/2 GET for a file larger than CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE (256 by default) triggers the bug.\n4. In a patched tree, grep -rn '&client->data_len' subsys/ finds no file_size out-parameter use.","fix":"Upgrade Zephyr to 4.3.2 (4.3 line) or 4.5.0 (4.4/4.5 line). Fix: handle_http2_static_fs_resource() uses a local size_t file_size instead of &client->data_len (commit 4e0a5f3). Zephyr v3.7 is not affected. Workaround until upgraded: disable CONFIG_HTTP_SERVER_VERSION_2 or do not register HTTP_RESOURCE_TYPE_STATIC_FS resources.","status":"open","published_at":"2026-11-10T22:21:05+00:00","first_seen_at":"2026-11-10T22:27:30+00:00","triaged_at":"2026-11-10T22:28:49+00:00","updated_at":"2026-11-10T22:29:15+00:00","category":"runtime","confidence":0.9,"triage":{"at":"2026-11-10T22:28:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Zephyr HTTP/2 server: static file request lets remote attackers corrupt memory","impact":"high","summary":"The HTTP/2 front end of the Zephyr HTTP server overwrites its own connection receive length with a static file's size when serving any file. That lets an unauthenticated remote client trigger out-of-bounds reads and writes and likely crash the device or run code.","audience":"developers","category":"runtime","nicknames":[],"who_cares":["zephyr","embedded","http-server","http2","iot"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"remote attacker corrupts device memory and may run code","analyst_note":"Fixed version not stated in the given sources; find the patched Zephyr release in the linked patch and vendor advisory on github.com.","how_to_check":"- Check whether the application registers a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with `CONFIG_FILE_SYSTEM=y` in its build.\n- Check whether `CONFIG_HTTP_SERVER_VERSION_2` is enabled in the project configuration (it is on by default).\n- Check the Zephyr version in use against the sources; the affected file is `subsys/net/lib/http/http_server_http2.c`.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["http2-disabled","no-static-fs","http1-or-http3-only"],"who_is_affected":"Applications built on Zephyr that run the HTTP server with HTTP/2 enabled and serve static files from a filesystem are exposed. The defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, with no TLS or credentials needed. Devices that do not serve static files through the HTTP/2 handler, or that have HTTP/2 disabled, are not exposed; HTTP/1 and HTTP/3 handlers are unaffected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000895,"input_tokens":5367,"output_tokens":717,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Fixed version not stated in the given sources; find the patched Zephyr release in the linked patch and vendor advisory on github.com.","search":"'-2026':13A,16A '-82391':14A,17A '0':404C '2':220C '24':311C '256':143C,349C 'address':433C 'adjac':380C 'afterward':180C 'alias':84C 'alreadi':462C 'append':280C 'applic':198C 'argument':408C 'attack':9A,411C,416C 'attacker-chosen':415C 'attacker-suppli':410C 'beyond':315C 'bit':312C 'bound':62B,166C,321C,421C 'buffer':134C,136C,141C,241C,294C,317C,327C,351C,394C,400C 'byte':123C,144C,263C,281C,346C,350C 'choos':270C 'chosen':417C 'client':57B,100C,115C,135C,140C,236C,265C,326C,328C,330C,358C,381C,391C,393C,395C,399C,401C 'code':73B,452C 'compact':324C 'config':137C,212C,216C 'connect':39B,85C,132C 'consum':277C 'context':382C 'control':261C,447C 'control-data':446C 'copi':339C 'corrupt':10A,427C 'count':120C 'crash':68B,438C 'credenti':229C 'ctx':359C 'current':362C 'cursor':266C,329C 'cve':12A,15A 'data':101C,116C,237C,257C,331C,396C,402C,413C,448C 'default':146C,224C 'defeat':288C 'defect':182C 'detail/current_stream':363C 'devic':70B,443C 'disk':174C 'dispatch':245C 'embed':19B 'enabl':222C 'end':30B,78C,253C,335C 'everi':149C 'exceed':239C 'execut':453C 'fabric':272C 'fd':392C 'file':5A,45B,51B,105C,114C,162C,170C,192C,213C,342C,481C 'file-s':341C 'filesystem':204C,460C 'find':113C 'fix':128C,471C 'fixed-s':127C 'frame':150C,244C,273C,297C,303C,313C 'front':29B,77C 'front-end':76C 'fs':97C,210C 'function':369C 'function-point':368C 'get':189C 'guard':291C 'handl':94C,338C 'handler':151C,304C,377C,461C,475C 'hang':440C 'header':298C 'http':21B,34B,82C,111C,138C,206C,217C,296C,357C 'http-server':20B 'http/1':455C 'http/2':2A,28B,75C,188C,474C 'http/3':457C 'http2':23B,95C 'impact':423C 'inact':374C 'includ':360C 'inflat':286C 'invari':148C 'iot':24B 'keep':249C 'lead':450C 'len':102C,117C,238C,332C,397C,403C 'length':41B,287C,314C,418C 'let':7A,53B 'like':67B 'local':465C,478C 'loop':246C 'machin':276C 'make':472C 'memmov':325C 'memori':11A,385C,426C 'minimum':436C 'next':278C 'noth':177C 'number':344C 'on-disk':172C 'out-of-bound':59B,318C 'out-paramet':107C 'output':91C 'overflow':352C 'overwrit':36B,449C 'paramet':109C 'pars':250C,295C 'parser':366C 'pass':99C 'past':251C 'path':156C,234C 'peer':260C 'per':131C,302C 'per-connect':130C 'per-fram':301C 'plausibl':445C 'pointer':364C,370C 'reach':184C 'read':63B,305C,322C 'receiv':40B,86C,133C,155C,256C 'recv':390C 'regist':200C 'reli':157C 'remain':124C 'remot':8A,56B,425C 'replac':164C 'request':6A,284C,337C 'requir':231C 'reset':178C 'resourc':98C,205C,207C 'rest':354C 'root':196C 'run':72B 'runtim':25B 'scratch':90C 'serv':49B,159C 'server':3A,22B,35B,83C,112C,139C,218C,430C 'set':367C 'singl':432C 'size':47B,106C,129C,142C,175C,242C,343C,407C,479C,482C 'sizeof':398C 'skip':307C 'socket':154C 'space':434C 'state':87C,275C 'static':4A,44B,96C,161C,203C,209C,384C,459C 'static-filesystem':202C,458C 'struct':356C 'subsequ':388C 'subsys/net/lib/http/http_server_core.c':248C 'subsys/net/lib/http/http_server_http2.c':93C 'suppli':412C 'system':214C 'tabl':371C 'therefor':163C 'timer':375C 'tls':227C 'trigger':58B 'type':208C 'unaffect':469C 'unauthent':55B,187C 'underflow':405C 'unprocess':122C 'use':463C,476C 'valu':167C 'variabl':466C 'version':219C 'web':195C 'well':484C 'work':376C 'write':65B,409C 'y':215C 'zephyr':1A,18A,26B,33B,81C 'zsock':389C","nicknames":[],"mitigations":[],"who_affected":"Devices and apps built on Zephyr 4.0.0 to 4.3.1, or 4.4.x, that run the built-in HTTP server with HTTP/2 enabled (the default) and serve static files from a filesystem resource. An unauthenticated client can send a GET for a file larger than the 256-byte client buffer (default), then corrupt memory: a crash or hang is the minimum, and the advisory calls code execution plausible. Skip it if HTTP/2 is disabled, you have no static-filesystem resource, or you are on v3.7. HTTP/1 and HTTP/3 handlers are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:29:10Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29","run_id":2984},"products":{"at":"2026-11-10T22:29:15Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29","run_id":2984},"how_to_check":{"at":"2026-11-10T22:29:10Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29","run_id":2984},"who_affected":{"at":"2026-11-10T22:29:10Z","by":"analyst","doc":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29","run_id":2984}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["zephyr"],"ptokens":["zephyr"],"labels":["critical","embedded","http2","httpserver","iot","runtime","zephyr"],"campaign_type":null,"search_a":"'-2026':13A,16A '-82391':14A,17A 'attack':9A 'corrupt':10A 'cve':12A,15A 'file':5A 'http/2':2A 'let':7A 'memori':11A 'remot':8A 'request':6A 'server':3A 'static':4A 'zephyr':1A,18A","search_b":"'bound':62B 'client':57B 'code':73B 'connect':39B 'crash':68B 'devic':70B 'embed':19B 'end':30B 'file':45B,51B 'front':29B 'http':21B,34B 'http-server':20B 'http/2':28B 'http2':23B 'iot':24B 'length':41B 'let':53B 'like':67B 'out-of-bound':59B 'overwrit':36B 'read':63B 'receiv':40B 'remot':56B 'run':72B 'runtim':25B 'serv':49B 'server':22B,35B 'size':47B 'static':44B 'trigger':58B 'unauthent':55B 'write':65B 'zephyr':26B,33B","search_c":"'0':404C '2':220C '24':311C '256':143C,349C 'address':433C 'adjac':380C 'afterward':180C 'alias':84C 'alreadi':462C 'append':280C 'applic':198C 'argument':408C 'attack':411C,416C 'attacker-chosen':415C 'attacker-suppli':410C 'beyond':315C 'bit':312C 'bound':166C,321C,421C 'buffer':134C,136C,141C,241C,294C,317C,327C,351C,394C,400C 'byte':123C,144C,263C,281C,346C,350C 'choos':270C 'chosen':417C 'client':100C,115C,135C,140C,236C,265C,326C,328C,330C,358C,381C,391C,393C,395C,399C,401C 'code':452C 'compact':324C 'config':137C,212C,216C 'connect':85C,132C 'consum':277C 'context':382C 'control':261C,447C 'control-data':446C 'copi':339C 'corrupt':427C 'count':120C 'crash':438C 'credenti':229C 'ctx':359C 'current':362C 'cursor':266C,329C 'data':101C,116C,237C,257C,331C,396C,402C,413C,448C 'default':146C,224C 'defeat':288C 'defect':182C 'detail/current_stream':363C 'devic':443C 'disk':174C 'dispatch':245C 'enabl':222C 'end':78C,253C,335C 'everi':149C 'exceed':239C 'execut':453C 'fabric':272C 'fd':392C 'file':105C,114C,162C,170C,192C,213C,342C,481C 'file-s':341C 'filesystem':204C,460C 'find':113C 'fix':128C,471C 'fixed-s':127C 'frame':150C,244C,273C,297C,303C,313C 'front':77C 'front-end':76C 'fs':97C,210C 'function':369C 'function-point':368C 'get':189C 'guard':291C 'handl':94C,338C 'handler':151C,304C,377C,461C,475C 'hang':440C 'header':298C 'http':82C,111C,138C,206C,217C,296C,357C 'http/1':455C 'http/2':75C,188C,474C 'http/3':457C 'http2':95C 'impact':423C 'inact':374C 'includ':360C 'inflat':286C 'invari':148C 'keep':249C 'lead':450C 'len':102C,117C,238C,332C,397C,403C 'length':287C,314C,418C 'local':465C,478C 'loop':246C 'machin':276C 'make':472C 'memmov':325C 'memori':385C,426C 'minimum':436C 'next':278C 'noth':177C 'number':344C 'on-disk':172C 'out-of-bound':318C 'out-paramet':107C 'output':91C 'overflow':352C 'overwrit':449C 'paramet':109C 'pars':250C,295C 'parser':366C 'pass':99C 'past':251C 'path':156C,234C 'peer':260C 'per':131C,302C 'per-connect':130C 'per-fram':301C 'plausibl':445C 'pointer':364C,370C 'reach':184C 'read':305C,322C 'receiv':86C,133C,155C,256C 'recv':390C 'regist':200C 'reli':157C 'remain':124C 'remot':425C 'replac':164C 'request':284C,337C 'requir':231C 'reset':178C 'resourc':98C,205C,207C 'rest':354C 'root':196C 'scratch':90C 'serv':159C 'server':83C,112C,139C,218C,430C 'set':367C 'singl':432C 'size':106C,129C,142C,175C,242C,343C,407C,479C,482C 'sizeof':398C 'skip':307C 'socket':154C 'space':434C 'state':87C,275C 'static':96C,161C,203C,209C,384C,459C 'static-filesystem':202C,458C 'struct':356C 'subsequ':388C 'subsys/net/lib/http/http_server_core.c':248C 'subsys/net/lib/http/http_server_http2.c':93C 'suppli':412C 'system':214C 'tabl':371C 'therefor':163C 'timer':375C 'tls':227C 'type':208C 'unaffect':469C 'unauthent':187C 'underflow':405C 'unprocess':122C 'use':463C,476C 'valu':167C 'variabl':466C 'version':219C 'web':195C 'well':484C 'work':376C 'write':409C 'y':215C 'zephyr':81C 'zsock':389C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-26T15:33:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"vulnerabilities@zephyrproject.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82391","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82391","severity":null,"published_at":"2026-11-10T22:21:05+00:00","modified_at":"2026-11-10T22:21:05+00:00","first_seen_at":"2026-11-10T22:27:30+00:00","fetched_at":"2026-11-10T22:27:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-82391:2984","url":null,"severity":null,"published_at":"2026-11-10T22:29:10+00:00","modified_at":"2026-11-10T22:29:15+00:00","first_seen_at":"2026-11-10T22:29:10+00:00","fetched_at":"2026-11-10T22:29:15+00:00","note":"Restated zephyr product as one row covering both ranges."}],"documents":[{"id":119540,"url":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":119541,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8jrg-wx88-g75j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-26T15:33:33+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}