CVE-2026-5067

A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bounded copy that does not guarantee NUL termination when the input length reaches the buffer size. During upgrade handling the buffer is copied to a local stack buffer and passed to strlen(); if no NUL exists in-bounds, strlen() reads beyond the stack buffer and subsequent concatenation with the WebSocket magic string can write out of bounds. This leads to out-of-bounds read and write on stack memory, resulting in crash (denial of service) and potentially code execution. The path is reachable when CONFIG_HTTP_SERVER_WEBSOCKET is enabled.

• CWE-170
• CWE-787
• CWE-787

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wgr4-9pwq-94vjExploit, Patch, Vendor Advisory
• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wgr4-9pwq-94vjExploit, Patch, Vendor Advisory

Published

Jun 9, 2026

Last Modified

Jul 23, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-50663Relative path traversal in Age of Empires II: Definitive Edi…8.8
• CVE-2026-50665Out-of-bounds read in Microsoft Office allows an unauthorize…3.3
• CVE-2026-50666Use after free in Windows Remote Access Connection Manager a…8.8
• CVE-2026-50667Concurrent execution using shared resource with improper syn…7
• CVE-2026-50668Heap-based buffer overflow in Windows NTFS allows an unautho…6.8
• CVE-2026-50669Concurrent execution using shared resource with improper syn…7
• CVE-2026-50670Out-of-bounds read in Windows Kernel allows an authorized at…7.8
• CVE-2026-50672Use after free in Windows NTFS allows an authorized attacker…7
• CVE-2026-50673Null pointer dereference in Windows Kernel allows an authori…7.8
• CVE-2026-50674Use after free in Windows USB Print Driver allows an authori…7.8
• CVE-2026-50675Heap-based buffer overflow in Microsoft Office Excel allows …7.8
• CVE-2026-50676Concurrent execution using shared resource with improper syn…7