CVE-2026-10848: OCPP 1.6 Client DOS Vulnerability

CVE-2026-10848 Overview

CVE-2026-10848 is an out-of-bounds read vulnerability [CWE-125] in the Open Charge Point Protocol (OCPP) 1.6 client shipped with the Zephyr real-time operating system. The flaw resides in parse_rpc_msg() inside subsys/net/lib/ocpp/ocpp_j.c, where the helper extract_string_field() uses strncpy() without ensuring NUL termination. When an inbound WebSocket Application Messaging Protocol (WAMP) Remote Procedure Call (RPC) frame contains a uid or action field of 127 or more bytes without a closing quote, a subsequent strchr() call reads past the 128-byte stack buffer. The OCPP feature is experimental and must be enabled via CONFIG_OCPP.

Critical Impact
A malicious or compromised OCPP central-system server, or an on-path attacker exploiting plaintext ws:// deployments, can send a crafted RPC frame to trigger a remote denial of service on the charging-station firmware.

Affected Products

Zephyr RTOS OCPP 1.6 client (subsys/net/lib/ocpp)
Firmware builds with CONFIG_OCPP enabled (experimental feature)
Devices communicating with OCPP central-system servers over WebSocket

Discovery Timeline

2026-08-02 - CVE-2026-10848 published to the National Vulnerability Database (NVD)
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-10848

Vulnerability Analysis

The OCPP 1.6 client parses inbound WAMP RPC frames received over a WebSocket connection. The reader thread fills recv_buf via websocket_recv_msg() and calls parse_rpc_msg() for each inbound DATA frame in subsys/net/lib/ocpp/ocpp.c. Parsing is delegated to a hand-rolled helper, extract_string_field(), which copies the uid and action fields with strncpy(out_buf, token + 1, outlen - 1) and then scans the destination with strchr(out_buf, '"').

Because strncpy() does not NUL-terminate the destination when the source length reaches or exceeds outlen - 1 (127 bytes), the subsequent strchr() continues scanning past the 128-byte destination buffer into adjacent stack memory. If a " byte is encountered beyond the buffer, the helper also writes a one-byte NUL, corrupting adjacent stack state. A related defect in extract_payload() runs strchr() and strrchr() over recv_buf, which may not be NUL-terminated when a maximal-length frame fills it. The over-read data is not returned to the peer, so information disclosure is bounded.

Root Cause

The root cause is misuse of strncpy() combined with the absence of an explicit NUL terminator on fixed-size stack buffers. The parser assumes copied fields are C strings suitable for strchr(), but the source data is attacker-controlled and unterminated. This matches the classic out-of-bounds read pattern tracked as [CWE-125].

Attack Vector

The parsed bytes originate directly from the OCPP central-system server. OCPP is commonly deployed over plaintext ws://, allowing an on-path attacker to inject a crafted RPC frame whose uid or action field contains 127 or more bytes with no closing quote character. A malicious or compromised central server can trigger the same condition. The unbounded scan can fault on an unmapped page, producing a remotely triggerable denial of service, and the stray NUL write can corrupt adjacent stack variables.

// Vulnerable helper removed by the upstream patch
-static int extract_string_field(char *out_buf, int outlen, char *token)
-{
-	char *end;
-
-	if (out_buf == NULL || token == NULL) {
-		return -EINVAL;
-	}
-
-	strncpy(out_buf, token + 1, outlen - 1);
-	end = strchr(out_buf, '"');
-	if (end != NULL) {
-		*end = '\0';
-	}
-
-	return 0;
-}

-static int extract_payload(char *msg, int msglen)
-{
-	size_t len;
-	char *start = strchr(msg, '{');
-	char *end = strrchr(msg, '}');
-
-	if (start == NULL || end == NULL || end < start) {
-		return -EINVAL;
-	}

Source: Zephyr commit e500f7b

Detection Methods for CVE-2026-10848

Indicators of Compromise

Unexpected crashes, resets, or watchdog reboots of Zephyr-based devices immediately after receiving OCPP traffic.
Inbound WAMP RPC frames whose uid or action fields exceed 127 bytes or lack a closing " character.
OCPP sessions established over plaintext ws:// to central-system endpoints outside the expected allowlist.

Detection Strategies

Inspect WebSocket payloads at the network boundary for OCPP frames containing oversized quoted fields or malformed JSON RPC envelopes.
Capture and review firmware crash dumps for faults inside parse_rpc_msg() or extract_string_field().
Perform binary or source audits for builds compiled with CONFIG_OCPP and validate the presence of the upstream fix.

Monitoring Recommendations

Log all OCPP central-system connection attempts and alert on unexpected peers or repeated abnormal disconnects.
Monitor charging-station availability metrics for correlated outages that could indicate exploitation attempts.
Enforce TLS-secured wss:// transport and alert on any downgrade to plaintext ws://.

How to Mitigate CVE-2026-10848

Immediate Actions Required

Update Zephyr to a revision that includes commit e500f7b81b5b8a867e28b2f4e59512cbfdd5ae75, which replaces the hand-rolled parser with json_mixed_arr_parse().
If patching is not immediately feasible, disable CONFIG_OCPP in the build configuration, as the feature is marked experimental.
Restrict OCPP connectivity to trusted central-system servers and enforce wss:// with mutual TLS authentication.

Patch Information

The upstream fix replaces extract_string_field() and extract_payload() with json_mixed_arr_parse(), which respects buffer bounds, and copies the extracted uid into an explicitly NUL-terminated buffer. See the Zephyr GHSA-jgqq-7mjj-w642 advisory and the patch commit for the complete change set, including the new json_ocpp_call_req_msg and json_ocpp_call_res_msg structures used by the bounds-respecting parser.

Workarounds

Disable the OCPP subsystem by unsetting CONFIG_OCPP in Kconfig until firmware can be updated.
Place charging stations behind a network segment that only permits outbound connections to a hardened, TLS-terminated OCPP gateway.
Deploy a protocol-aware proxy that validates OCPP JSON envelopes and drops frames with malformed or oversized uid or action fields.

bash

# Kconfig workaround: disable the experimental OCPP client until patched
# In prj.conf or the board defconfig
CONFIG_OCPP=n

# Verify the resulting build does not link the vulnerable object
west build -t menuconfig
grep -R "CONFIG_OCPP" build/zephyr/.config