CVE-2026-5067 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-5067 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-5067 is a critical memory-corruption flaw in Zephyr’s HTTP server WebSocket upgrade path, with a CVSS of 9.8. A remote, unauthenticated attacker can send a crafted Sec-WebSocket-Key header and trigger out-of-bounds read/write on stack memory when CONFIG_HTTP_SERVER_WEBSOCKET is enabled. Impact ranges from a crash and service outage to potential code execution.

This is especially important for solo developers and small teams because the attack does not require credentials, and the vulnerable path is exposed through a common HTTP endpoint. Even though there is no known exploitation in the wild and it is not in CISA KEV, the severity means it should be treated as an urgent patch-and-verify item.

Immediate Action

  • Patch Zephyr immediately to the first fixed release or commit that addresses CVE-2026-5067. TODO: insert vendor-fixed version here if available.
  • Disable WebSocket support by turning off CONFIG_HTTP_SERVER_WEBSOCKET until you can confirm the fix is deployed.
  • Isolate the service from the public internet if it must remain online temporarily; restrict access with firewall rules, VPN, or allowlists.
  • Roll back to a known-safe build if you cannot patch quickly and WebSocket support is not required.
  • Review vendor guidance and release notes: Vendor advisory / release notes.

Affected Versions

  • Zephyr HTTP server with CONFIG_HTTP_SERVER_WEBSOCKET=y vulnerable in affected releases prior to the fix. TODO: list exact vulnerable version range once confirmed.
  • Zephyr@<FIXED_VERSION_TODO vulnerable; upgrade to FIXED_VERSION_TODO or later.
  • Any build that includes the WebSocket upgrade path and ships the vulnerable HTTP/1 header parsing behavior is at risk.
  • CONFIG_HTTP_SERVER_WEBSOCKET=n is the safest immediate mitigation if you cannot patch right away.

Resolution Guide

1) Update Zephyr / your firmware dependency

# Zephyr (west-based workflow)
west update
# Then rebuild with the fixed Zephyr revision once pinned
west build -b <your_board> <your_app>

2) Disable the vulnerable feature if you do not need WebSockets

# prj.conf
CONFIG_HTTP_SERVER=y
# Temporary mitigation:
CONFIG_HTTP_SERVER_WEBSOCKET=n

3) If you package Zephyr in a container or appliance image, rebuild and republish

# Docker example
docker build -t yourorg/yourapp:patched .
docker push yourorg/yourapp:patched

4) Common ecosystem commands for dependency pinning

# npm / yarn / pnpm (if Zephyr is wrapped by a JS build or SDK package)
npm i <package>@<fixed_version>
yarn add <package>@<fixed_version>
pnpm add <package>@<fixed_version>

# pip / pipx (for tooling that pulls the affected SDK or build helpers)
pip install --upgrade <package>==<fixed_version>
pipx upgrade <package>

# Maven / Gradle (if using a Java-based build wrapper or firmware toolchain)
# Maven pom.xml: set version to <fixed_version>
# Gradle build.gradle:
implementation("<group>:<artifact>:<fixed_version>")

# apt / yum (if your build host distributes a patched Zephyr package)
sudo apt-get update && sudo apt-get install --only-upgrade <package>
sudo yum update <package>

5) Minimal code/config hardening example

// Defensive guard around WebSocket upgrade handling
if (!IS_ENABLED(CONFIG_HTTP_SERVER_WEBSOCKET)) {
    return -ENOTSUP;
}

/* TODO: ensure Sec-WebSocket-Key is NUL-terminated before strlen()
 * and reject headers that fill the buffer exactly.
 */

Detection & Verification

Check whether you are vulnerable:

# Search your build config
grep -R "CONFIG_HTTP_SERVER_WEBSOCKET" -n .config prj.conf boards/ 2>/dev/null

# Confirm Zephyr revision
git -C <zephyr-tree> rev-parse HEAD
git -C <zephyr-tree> describe --tags --always

# Look for the upgrade path in source
grep -R "Sec-WebSocket-Key\|WebSocket upgrade\|strlen(" -n subsys/ net/ include/ 2>/dev/null

Verify the fix:

# Rebuild after patching and confirm the feature flag state
grep "CONFIG_HTTP_SERVER_WEBSOCKET" build/zephyr/.config

# Run dependency/security checks where applicable
npm audit
pip audit
mvn -q -DskipTests dependency:tree
./gradlew dependencies

# If you have a test harness, send a long Sec-WebSocket-Key and confirm rejection
# Expect: request rejected or safely handled, not crash/reboot

Operational verification: monitor for unexpected reboots, stack traces, watchdog resets, or HTTP server crashes after receiving WebSocket upgrade requests. If you have logs, search for malformed upgrade headers or failures around header parsing and strlen()-related faults.

Risk and Impact

This bug can be triggered remotely with a single crafted HTTP request, so the blast radius includes any exposed device or service using Zephyr’s HTTP server with WebSocket support enabled. The most likely outcome is a crash and denial of service, but because the flaw involves stack memory corruption, code execution cannot be ruled out.

For small teams, the practical risk is high: embedded devices are often hard to patch quickly, may be deployed in the field, and are easy to overlook in asset inventories. Treat this as a stop-ship issue until you have confirmed either a patched build or that CONFIG_HTTP_SERVER_WEBSOCKET is disabled.

Keep reading