CVE-2026-11810: UpdateHub Firmware Agent DoS Vulnerability

CVE-2026-11810 Overview

CVE-2026-11810 is a NULL pointer dereference [CWE-476] in the Zephyr Real-Time Operating System (RTOS) UpdateHub firmware-update agent. The z_impl_updatehub_probe() function in subsys/mgmt/updatehub/updatehub.c parses JSON metadata received from an UpdateHub server over Constrained Application Protocol (CoAP). The parser validates only the outer array length before dereferencing an inner object array pointer through strlen(). A malicious update server, or a network man-in-the-middle when Datagram Transport Layer Security (DTLS) is disabled, can return crafted metadata that triggers a fatal CPU fault on the target device.

Critical Impact
A remote attacker can halt or reset Zephyr devices running the UpdateHub OTA client by returning malformed metadata during a routine probe, causing a persistent denial of service on affected embedded devices.

Affected Products

Zephyr RTOS UpdateHub management subsystem (subsys/mgmt/updatehub/updatehub.c)
Devices using the updatehub_probe() OTA probe handler
Deployments running UpdateHub with DTLS disabled (also exposed to on-path attackers)

Discovery Timeline

2026-08-10 - CVE-2026-11810 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-11810

Vulnerability Analysis

The UpdateHub agent fetches update metadata over CoAP and parses it into a fixed two-level nested-array structure. After parsing, the code validates only the outer array length with a check equivalent to objects_len != 2. It then dereferences objects[1].objects[0].objects.sha256sum through strlen() without confirming that the inner object array of element [1] is non-empty.

Because the parse target is zero-initialized, an empty inner array leaves the sha256sum pointer at NULL. The subsequent strlen() call reads from address zero, producing a fatal CPU fault. Under Zephyr's default error handling, this halts or resets the device.

The same defect exists in both the any boards and some boards metadata layouts. Impact is limited to availability; the flaw is a read from NULL and does not enable out-of-bounds writes, memory corruption, or information disclosure.

Root Cause

The root cause is missing validation of the inner objects_len field before pointer dereference. The parser trusts the second nesting level of attacker-influenced input without verifying its length, violating basic defensive parsing practice for network-derived data [CWE-476].

Attack Vector

The metadata is attacker-influenceable network input. Exploitation requires either a malicious or compromised UpdateHub server, or a man-in-the-middle position when DTLS is not enabled. The attacker returns a CoAP response whose second outer object array is empty. No authentication or user interaction is required on the target device; the fault triggers during the agent's routine OTA probe.

// Security patch in subsys/mgmt/updatehub/updatehub.c
// mgmt: updatehub: validate inner metadata object length
 			goto cleanup;
 		}
 
+		if (metadata_any_boards.objects[1].objects_len == 0) {
+			LOG_ERR("Inner object array of 'any metadata' is empty");
+			ctx.code_status = UPDATEHUB_METADATA_ERROR;
+			goto cleanup;
+		}
+
 		sha256size = strlen(
 			metadata_any_boards.objects[1].objects[0].objects.sha256sum) + 1;

Source: GitHub Commit 3424082

Detection Methods for CVE-2026-11810

Indicators of Compromise

Unexpected device resets or fatal fault log entries coinciding with UpdateHub probe cycles
CoAP responses to the UpdateHub client whose JSON metadata contains an empty second-level object array
UpdateHub client logs showing crashes inside or immediately after z_impl_updatehub_probe()

Detection Strategies

Inspect CoAP traffic between Zephyr devices and UpdateHub servers for metadata payloads with empty inner objects arrays
Correlate device reboot telemetry with OTA probe intervals to identify probe-triggered faults
Review firmware crash dumps for NULL pointer faults originating in updatehub.c

Monitoring Recommendations

Enable and centralize Zephyr fault logs and UpdateHub agent logs for fleet-wide visibility
Monitor UpdateHub server certificates and DTLS session establishment to detect on-path interception
Alert on repeated device resets across multiple endpoints within a single probe interval

How to Mitigate CVE-2026-11810

Immediate Actions Required

Apply the upstream Zephyr patch that validates inner objects_len before dereference in both metadata layouts
Enable DTLS for all UpdateHub CoAP communication to eliminate the man-in-the-middle attack path
Restrict outbound CoAP traffic from devices to known, trusted UpdateHub server endpoints

Patch Information

The fix is committed in the Zephyr project at GitHub Commit 3424082. It rejects metadata whose inner object array is empty before any dereference, on both the any boards and some boards layouts. Additional context is available in the GitHub Security Advisory GHSA-jfpc-324j-84ww.

Workarounds

Disable the UpdateHub subsystem on devices where OTA updates are not actively required until the patch is deployed
Enforce DTLS with mutual authentication so only trusted servers can deliver metadata to the probe handler
Pin the UpdateHub server address and block CoAP traffic to unauthorized destinations at the network gateway

bash

# Zephyr Kconfig example: require DTLS for UpdateHub CoAP transport
CONFIG_UPDATEHUB=y
CONFIG_UPDATEHUB_DTLS=y
CONFIG_UPDATEHUB_CA_CERTIFICATE="/path/to/trusted-ca.pem"
CONFIG_UPDATEHUB_SERVER="coaps://updatehub.example.com"