CVE-2026-5067: Zephyr HTTP Server RCE Vulnerability

CVE-2026-5067 is a remote code execution vulnerability in Zephyr's HTTP Server affecting WebSocket upgrade handling. Attackers can exploit memory corruption to cause crashes or execute code. This article covers technical details, affected configurations, impact assessment, and mitigation strategies.

CVE-2026-5067 Overview

CVE-2026-5067 is a memory corruption vulnerability in the Zephyr real-time operating system (RTOS) HTTP server WebSocket upgrade handler. A remote, unauthenticated attacker can trigger out-of-bounds read and write conditions on stack memory by sending a crafted Sec-WebSocket-Key header. The flaw is reachable on any Zephyr build that enables CONFIG_HTTP_SERVER_WEBSOCKET, which is common in embedded and Internet of Things (IoT) devices that expose web interfaces.

Critical Impact
Successful exploitation results in denial of service through crash, with potential for remote code execution on affected embedded targets.

Affected Products

Zephyr RTOS HTTP server component
Builds with CONFIG_HTTP_SERVER_WEBSOCKET enabled
Embedded and IoT devices using Zephyr's networking stack to expose WebSocket endpoints

Discovery Timeline

2026-06-09 - CVE-2026-5067 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-5067

Vulnerability Analysis

The vulnerability resides in Zephyr's HTTP/1 header parser and the WebSocket upgrade path. The parser copies incoming header values into a fixed-size buffer using a bounded copy routine. When the input length reaches the exact buffer size, the routine does not guarantee NUL termination, leaving the buffer without a trailing zero byte.

During upgrade handling, the server copies that buffer onto a local stack buffer and calls strlen() to measure it. Without an in-bounds NUL byte, strlen() reads beyond the stack buffer until it finds an arbitrary zero in adjacent memory. The server then concatenates the WebSocket magic string 258EAFA5-E914-47DA-95CA-C5AB0DC85B11 to the buffer, writing past its boundary.

This pattern matches [CWE-170: Improper Null Termination] and produces both an out-of-bounds read and an out-of-bounds write on the stack. The write primitive can corrupt saved return addresses or adjacent local variables on architectures without stack canaries, enabling control-flow hijacking on embedded targets.

Root Cause

The root cause is a bounded string copy that omits NUL termination when the source matches the destination buffer size. Downstream code assumes the buffer is a valid C string and calls strlen() followed by string concatenation. The trust boundary between the parser and the upgrade handler does not validate termination invariants.

Attack Vector

An unauthenticated remote attacker sends a single HTTP request to a Zephyr device that exposes a WebSocket endpoint. The request includes a Sec-WebSocket-Key header sized to fill the parser's destination buffer exactly, defeating NUL termination. The upgrade handler then triggers the out-of-bounds operations during string processing. No user interaction or prior credentials are required.

The vulnerability is described in prose only; see the GitHub Security Advisory GHSA-wgr4-9pwq-94vj for upstream technical details.

Detection Methods for CVE-2026-5067

Indicators of Compromise

Unexpected crashes, resets, or watchdog reboots on Zephyr devices shortly after inbound HTTP traffic to WebSocket endpoints
HTTP requests containing oversized or non-printable Sec-WebSocket-Key header values that match or exceed the parser buffer size
Repeated WebSocket upgrade attempts from a single source against embedded HTTP listeners

Detection Strategies

Inspect HTTP traffic at the network edge for Sec-WebSocket-Key headers that deviate from the expected 24-character base64 length defined in RFC 6455
Correlate device crash telemetry and core dumps with inbound WebSocket upgrade requests in the same time window
Deploy intrusion detection signatures that flag malformed WebSocket upgrade handshakes targeting embedded HTTP servers

Monitoring Recommendations

Forward Zephyr device logs and crash traces to a centralized logging platform for correlation with network telemetry
Monitor inventories of devices built with CONFIG_HTTP_SERVER_WEBSOCKET and track their firmware versions
Alert on any new external connectivity to embedded device WebSocket ports that were previously isolated

How to Mitigate CVE-2026-5067

Immediate Actions Required

Identify all Zephyr-based devices in the environment and confirm whether CONFIG_HTTP_SERVER_WEBSOCKET is enabled in deployed firmware
Apply the upstream Zephyr patch referenced in the security advisory and rebuild affected firmware images
Restrict network access to device HTTP and WebSocket ports using firewall rules until patched firmware is deployed

Patch Information

The Zephyr project has published the fix and remediation guidance in the GitHub Security Advisory GHSA-wgr4-9pwq-94vj. Rebuild firmware from a patched Zephyr revision and redeploy to all affected devices.

Workarounds

Disable CONFIG_HTTP_SERVER_WEBSOCKET in the Zephyr build configuration if WebSocket functionality is not required
Place vulnerable devices behind a reverse proxy or gateway that validates and normalizes the Sec-WebSocket-Key header length before forwarding
Segment embedded devices onto isolated VLANs and block inbound HTTP from untrusted networks

bash

# Disable WebSocket support in Zephyr build configuration (prj.conf)
CONFIG_HTTP_SERVER_WEBSOCKET=n