CVE-2026-5067: Zephyr HTTP WebSocket upgrade out-of-bounds read/write via Sec-WebSocket-Key

Overview

CVE-2026-5067 is a memory safety flaw in the WebSocket upgrade handling of Zephyr's HTTP server. According to the record, the HTTP/1 header parser copies the Sec-WebSocket-Key header with a bounded copy that may not leave a terminating NUL byte, and later stack-based string handling can read and write past the end of its buffers. The weakness is classified as CWE-787 (Out-of-bounds Write).

Impact

The record states that the flaw can produce out-of-bounds reads and writes on stack memory, resulting in a crash (denial of service) and potentially code execution. The CVSS 3.1 base score is 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, meaning network reachability, no privileges or user interaction required, and high impact to confidentiality, integrity and availability as scored by the CNA.

Affected products and versions

The record lists two affected entries for Zephyr:

• Zephyrproject Zephyr: from 3.7.0 up to and including 4.3.0.
• Zephyrproject-rtos Zephyr: from 3.7.0 before 4.3.1.

The flaw is reachable only when CONFIG_HTTP_SERVER_WEBSOCKET is enabled, according to the record. Confirm the exact build configuration and version of each deployed firmware image against the GitHub security advisory.

Exploitation status

The CISA KEV catalog does not list this CVE in the record, so no confirmed active exploitation is recorded there. The sources consulted do not confirm exploitation in the wild. The SSVC data in the record marks exploitation as proof-of-concept and automatable, which indicates that exploitation feasibility is assessed as plausible but does not confirm observed attacks. The EPSS probability in the record is 0.00865.

Remediation and mitigation

• Upgrade Zephyr to 4.3.1 or later, as the affected range for the second listed entry ends before that version. Verify the fix against the vendor advisory.
• Until upgrading is possible, check whether the HTTP server WebSocket feature is needed. If it is not required, disabling CONFIG_HTTP_SERVER_WEBSOCKET removes the reachable code path described in the record.
• Restrict access to the HTTP server to trusted networks where feasible, since the flaw is network reachable without authentication.

Detection guidance

• Monitor devices running Zephyr HTTP servers for unexpected crashes, watchdog resets or reboots, which may indicate memory corruption attempts.
• Review HTTP server logs for WebSocket upgrade requests carrying unusually long or malformed Sec-WebSocket-Key headers.
• Inventory devices by Zephyr version and by the CONFIG_HTTP_SERVER_WEBSOCKET setting to prioritize affected systems.

Limitations of the available information

The record does not provide a fixed version explicitly in the fixes data beyond the advisory link, so the fixed version is inferred from the affected range ending before 4.3.1. The record does not describe the exact exploitation technique, the affected hardware targets, or whether any public exploit exists beyond the SSVC proof-of-concept indicator. The sources do not confirm whether 4.3.1 is the only corrective release for every branch.

Frequently asked questions

Is CVE-2026-5067 being actively exploited?

The record shows the CVE is not listed in CISA KEV, and the sources consulted do not confirm active exploitation. The SSVC data marks exploitation as proof-of-concept.

Which Zephyr versions are affected?

The record lists from 3.7.0 up to and including 4.3.0 for one entry, and from 3.7.0 before 4.3.1 for the other. The flaw requires CONFIG_HTTP_SERVER_WEBSOCKET to be enabled.

What should administrators do first?

Upgrade to 4.3.1 or later where possible. If WebSocket support is not needed, disable CONFIG_HTTP_SERVER_WEBSOCKET until the upgrade is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.