CVE-2026-29035: CivetWeb Buffer Overflow Vulnerability

CVE-2026-29035 Overview

CVE-2026-29035 is a heap and stack buffer overflow vulnerability in the CivetWeb embedded web server. The flaw resides in the read_websocket() function and affects builds compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES defined. Unauthenticated remote attackers can corrupt memory by sending compressed WebSocket frames after negotiating the permessage-deflate extension during the handshake. The vulnerability is tracked under [CWE-787] Out-of-bounds Write and was identified in CivetWeb commit 4a4f0c95.

Critical Impact
Remote unauthenticated attackers can trigger heap metadata corruption, causing denial of service or potentially achieving code execution against affected CivetWeb deployments.

Affected Products

CivetWeb embedded web server (commit 4a4f0c95)
Builds compiled with USE_ZLIB defined
Builds compiled with MG_EXPERIMENTAL_INTERFACES defined

Discovery Timeline

2026-08-11 - CVE CVE-2026-29035 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-29035

Vulnerability Analysis

The vulnerability exists in CivetWeb's WebSocket compression handling code path. When a client negotiates the permessage-deflate extension during the WebSocket handshake, the server prepares to decompress subsequent frames marked with the RSV1 bit. The read_websocket() function processes these frames and appends a 4-byte zlib sync trailer (0x00 0x00 0xff 0xff) required by the deflate stream format before decompression.

The server writes this trailer past the end of the allocated buffer holding the compressed payload. This out-of-bounds write corrupts adjacent memory on the heap or stack depending on how the frame buffer was allocated. The result is heap metadata corruption that can crash the process or be leveraged for arbitrary code execution.

Root Cause

The root cause is missing bounds checking in the sync-trailer append logic within read_websocket(). The code assumes sufficient space follows the compressed payload buffer without validating available capacity before writing the 4-byte trailer. Because the affected code paths are gated on USE_ZLIB and MG_EXPERIMENTAL_INTERFACES, only builds that enable experimental compression features are vulnerable.

Attack Vector

Exploitation requires network reachability to a vulnerable CivetWeb WebSocket endpoint. The attacker completes a standard WebSocket handshake and advertises permessage-deflate in the Sec-WebSocket-Extensions header. Once the server accepts the extension, the attacker sends a crafted WebSocket frame with the RSV1 compression bit set and a payload sized to trigger the out-of-bounds write when the server appends the zlib sync trailer.

No authentication is required. See the VulnCheck Advisory on CivetWeb for additional technical detail.

Detection Methods for CVE-2026-29035

Indicators of Compromise

WebSocket handshake requests containing Sec-WebSocket-Extensions: permessage-deflate directed at CivetWeb servers not expected to accept compression
Unexpected crashes, segmentation faults, or abnormal restarts of CivetWeb processes shortly after WebSocket traffic
WebSocket frames with the RSV1 bit set arriving from untrusted clients

Detection Strategies

Inspect HTTP upgrade traffic at network sensors for permessage-deflate negotiation against inventoried CivetWeb endpoints
Enable core dump collection and monitor for heap corruption signatures (malloc assertions, glibc double free or corruption messages) in CivetWeb logs
Instrument development and staging builds with AddressSanitizer to identify out-of-bounds writes in read_websocket() during fuzzing

Monitoring Recommendations

Alert on repeated WebSocket connections from a single source that terminate abnormally on CivetWeb hosts
Track process restart frequency for embedded services using CivetWeb as their HTTP or WebSocket engine
Log the full Sec-WebSocket-Extensions header value at reverse proxies fronting CivetWeb to establish a baseline

How to Mitigate CVE-2026-29035

Immediate Actions Required

Identify all deployments running CivetWeb, particularly embedded appliances and IoT firmware that bundle it
Determine whether affected builds were compiled with USE_ZLIB and MG_EXPERIMENTAL_INTERFACES
Restrict network access to WebSocket endpoints served by CivetWeb until a fixed build is deployed
Monitor the GitHub CivetWeb Repository for an official patch addressing the read_websocket() bounds check

Patch Information

At time of publication, the vulnerability is documented against CivetWeb commit 4a4f0c95. Consult the GitHub CivetWeb Repository and the VulnCheck Advisory on CivetWeb for the current patch status and recommended commit to upgrade to.

Workarounds

Rebuild CivetWeb without MG_EXPERIMENTAL_INTERFACES to disable the vulnerable code path
Rebuild CivetWeb without USE_ZLIB if WebSocket compression is not required
Strip the permessage-deflate extension at an upstream reverse proxy so it is never negotiated with the CivetWeb backend
Disable WebSocket endpoints entirely on affected servers where the functionality is not needed

bash

# Rebuild CivetWeb without the vulnerable experimental interface
make clean
make WITH_WEBSOCKET=1 WITH_ZLIB=0 WITH_EXPERIMENTAL=0

# Example nginx reverse-proxy directive to strip permessage-deflate
# before forwarding the upgrade request to CivetWeb
proxy_set_header Sec-WebSocket-Extensions "";