CVE-2026-11809: UpdateHub OTA Client DoS Vulnerability

CVE-2026-11809 Overview

CVE-2026-11809 is an out-of-bounds read and uninitialized memory use flaw in the Zephyr RTOS UpdateHub over-the-air (OTA) client. The defect resides in z_impl_updatehub_probe() within subsys/mgmt/updatehub/updatehub.c. A secondary heap buffer metadata_copy is allocated with k_malloc() and populated via memcpy() without copying the terminating NUL byte. A subsequent strlen() call can scan past the allocation into uninitialized heap memory, producing an over-long length that is then parsed as JSON. The condition is triggered by a probe response from a malicious, compromised, or on-path UpdateHub server when CONFIG_UPDATEHUB_DTLS is not enabled. This corresponds to [CWE-125] Out-of-Bounds Read.

Critical Impact
A network-reachable UpdateHub server can crash the Zephyr update thread and cause a device-level denial of service.

Affected Products

Zephyr RTOS builds that include the UpdateHub OTA client (subsys/mgmt/updatehub)
Devices operating without CONFIG_UPDATEHUB_DTLS on untrusted networks
Firmware images built before commit 69bbed5e601495a2076f25d822adbf991cae5c01

Discovery Timeline

2026-08-10 - CVE-2026-11809 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-11809

Vulnerability Analysis

The UpdateHub OTA client receives a probe response from the configured UpdateHub server and stores the payload in a heap buffer named metadata. That buffer is correctly NUL-terminated. The client then allocates a second buffer, metadata_copy, using k_malloc(), which does not zero the returned memory. The client fills metadata_copy via memcpy(metadata_copy, metadata, strlen(metadata)), omitting the trailing NUL byte. All bytes after the copied content remain uninitialized heap contents.

The client first calls json_obj_parse() against the array descriptor over metadata. If that parse fails, it falls back to json_obj_parse(metadata_copy, strlen(metadata_copy), ...). The strlen() call scans past the copied bytes into uninitialized heap. If no zero byte appears before the end of the allocation, strlen() reads past the allocation boundary. The resulting inflated length is then passed to the JSON parser.

Root Cause

The root cause is missing initialization of a heap allocation combined with a copy that omits the NUL terminator. Because k_malloc() returns unzeroed memory and memcpy copies only strlen(metadata) bytes, metadata_copy is not guaranteed to be NUL-terminated within its allocation. Subsequent use of strlen() on that buffer becomes unbounded.

Attack Vector

Exploitation requires an attacker-controlled or on-path UpdateHub server. The attacker crafts a probe response that fails the first json_obj_parse() call over the array descriptor, forcing the fallback path. The response is sized to trigger the over-read. The over-read data is consumed only internally by the JSON parser and is not returned to the attacker, so there is no information disclosure primitive. The observed outcome is a memory fault that crashes the update thread and the device.

 	LOG_DBG("metadata size: %d", strlen(metadata));
 	LOG_HEXDUMP_DBG(metadata, MAX_DOWNLOAD_DATA, "metadata");
 
+	memset(metadata_copy, 0, MAX_DOWNLOAD_DATA);
 	memcpy(metadata_copy, metadata, strlen(metadata));
 	if (json_obj_parse(metadata, strlen(metadata),
 			   recv_probe_sh_array_descr,

Source: Zephyr commit 69bbed5. The patch adds a memset() that zeroes metadata_copy before the memcpy, guaranteeing NUL termination within the allocation and bounding strlen().

Detection Methods for CVE-2026-11809

Indicators of Compromise

Unexpected crashes or resets in the Zephyr update thread following a probe request to the UpdateHub server
UpdateHub probe responses that are unusually large or that fail initial JSON array parsing
Devices contacting UpdateHub endpoints over plain UDP or CoAP without DTLS

Detection Strategies

Inspect firmware images for the presence of the UpdateHub subsystem and verify whether the memset() fix is applied to updatehub.c
Monitor network traffic between IoT devices and UpdateHub servers for malformed or oversized probe responses
Correlate device reboots or watchdog resets with recent OTA probe activity in device logs

Monitoring Recommendations

Log and alert on UpdateHub server certificate changes and unexpected server endpoints in device configuration
Track device crash telemetry and match against OTA update windows to identify probe-triggered faults
Enforce network segmentation policies that isolate OTA management traffic and generate alerts on deviations

How to Mitigate CVE-2026-11809

Immediate Actions Required

Rebuild affected firmware against a Zephyr revision that includes commit 69bbed5e601495a2076f25d822adbf991cae5c01 and deploy updated images to devices
Enable CONFIG_UPDATEHUB_DTLS so probe responses come from an authenticated server and cannot be injected by on-path attackers
Restrict outbound connectivity from Zephyr devices to known-good UpdateHub server addresses only

Patch Information

The upstream fix is available in the Zephyr Project repository. See the Zephyr commit 69bbed5 and the GitHub Security Advisory GHSA-6r86-hvv2-h6g4. The patch inserts a memset(metadata_copy, 0, MAX_DOWNLOAD_DATA) before the memcpy, ensuring strlen() cannot scan past the allocation.

Workarounds

Disable the UpdateHub OTA client on devices that do not require remote firmware updates
Deploy DTLS with certificate pinning to prevent on-path servers from serving crafted probe payloads
Place devices behind a gateway that validates UpdateHub JSON responses before forwarding them to endpoints

bash

# Enable DTLS for UpdateHub in prj.conf
CONFIG_UPDATEHUB=y
CONFIG_UPDATEHUB_DTLS=y
CONFIG_UPDATEHUB_CA_CERTIFICATE="/path/to/updatehub-ca.pem"