CVE-2026-8047: HTTP Request Parsing DoS Vulnerability

CVE-2026-8047 Overview

CVE-2026-8047 is an out-of-bounds write vulnerability caused by improper length checking during HTTP request parsing. An unauthenticated remote attacker can send a crafted HTTP request to trigger a size-limited memory write outside the intended buffer. The result is a system crash on the affected device, producing a denial-of-service condition. The flaw is tracked under CWE-1284 (Improper Validation of Specified Quantity in Input) and is documented in CERT-VDE Advisory VDE-2026-057. The vulnerability is network-exploitable, requires no privileges, and no user interaction.

Critical Impact
An unauthenticated remote attacker can crash the affected device with a single malformed HTTP request, disrupting availability of services exposed over the network.

Affected Products

Specific vendor and product details are coordinated through CERT-VDE. Refer to CERT-VDE Advisory VDE-2026-057 for the authoritative affected product list.
Any device exposing the vulnerable HTTP parsing component to untrusted networks is in scope.
Operational technology and embedded systems coordinating disclosures through CERT-VDE are typical candidates.

Discovery Timeline

2026-05-26 - CVE-2026-8047 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-8047

Vulnerability Analysis

The vulnerability lives in the HTTP request parsing logic of the affected products. When an incoming request is processed, the parser fails to correctly validate length fields before writing data into a fixed-size buffer. This mismatch between declared and actual length permits a write past the allocated boundary. Because the write is size-limited, the corruption does not enable arbitrary code execution. The corruption is sufficient, however, to destabilize the runtime state and crash the device. Recovery requires a reboot or watchdog-driven restart, during which the device cannot serve legitimate traffic.

Root Cause

The root cause is classified as [CWE-1284] Improper Validation of Specified Quantity in Input. The HTTP parser trusts a length value derived from attacker-controlled request data without enforcing strict bounds against the destination buffer. When the supplied quantity exceeds the safe write window, the parser still proceeds with the copy. Memory adjacent to the buffer is overwritten, leading to integrity loss in control structures used by the request handler.

Attack Vector

The attack vector is the network. An attacker only needs reachable connectivity to the HTTP service on the affected device. No authentication, credentials, or prior foothold are required, and no user interaction is involved. The attacker sends a single crafted HTTP request containing a manipulated length field. Upon parsing, the out-of-bounds write corrupts adjacent memory and triggers a fault that crashes the device. Repeated requests can be used to maintain a persistent denial-of-service condition against exposed devices.

No verified proof-of-concept code is publicly available. See CERT-VDE Advisory VDE-2026-057 for vendor-provided technical detail.

Detection Methods for CVE-2026-8047

Indicators of Compromise

Unexpected device reboots or watchdog-triggered restarts immediately following inbound HTTP traffic from untrusted sources.
Anomalous HTTP requests containing oversized or malformed headers, abnormal Content-Length values, or non-conforming length fields.
Loss of network reachability or HTTP service availability for the affected device with no corresponding administrative action.

Detection Strategies

Inspect HTTP traffic destined for embedded and operational devices for malformed length fields and oversized header values using network intrusion detection signatures.
Correlate device crash and reboot events from syslog with preceding inbound HTTP sessions to identify exploitation attempts.
Baseline normal HTTP request structure to the affected services and alert on deviations in header size, request line length, or chunked-encoding anomalies.

Monitoring Recommendations

Forward device system logs, watchdog events, and HTTP server logs to a centralized analytics platform for correlation.
Monitor uptime metrics on affected devices and alert on unscheduled restarts following external HTTP connections.
Track source IP addresses that send malformed HTTP requests and apply reputation-based blocking at upstream firewalls.

How to Mitigate CVE-2026-8047

Immediate Actions Required

Restrict network access to the HTTP service on affected devices using firewall rules that allow only trusted management networks.
Place affected devices behind a reverse proxy or HTTP-aware gateway that enforces strict request validation.
Identify all instances of the affected products in the environment and prioritize internet-exposed assets for remediation.

Patch Information

Consult CERT-VDE Advisory VDE-2026-057 for vendor-supplied firmware updates and version-specific remediation guidance. Apply the vendor's recommended firmware as soon as it is available and verified in a staging environment.

Workarounds

Disable the HTTP interface on affected devices when it is not operationally required.
Enforce network segmentation so that affected devices are not reachable from untrusted networks or the public internet.
Deploy a web application firewall in front of affected devices to reject HTTP requests with abnormal length fields and oversized headers.

bash

# Example: restrict HTTP access to a trusted management subnet using iptables
iptables -A INPUT -p tcp --dport 80 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP