Zephyr’s HTTP server places the Sec-WebSocket-Key header into a fixed-size buffer without NUL termination when the header’s length reaches the buffer size. During the WebSocket upgrade, this unsanitized buffer is copied again and passed to strlen(), allowing a crafted header to read beyond the buffer and subsequently write beyond the stack buffer when the WebSocket magic string is concatenated. The resulting out-of-bounds read and write can cause a crash and may enable arbitrary code execution by an unauthenticated remote attacker. The flaw is exercised only when the CONFIG_HTTP_SERVER_WEBSOCKET option is enabled.

All Zephyr RTOS configurations that enable the HTTP server WebSocket support are affected. The advisory lists the Zephyr project as the vendor/product, but no specific release or version numbers are provided, so any build compiled with CONFIG_HTTP_SERVER_WEBSOCKET remains potentially vulnerable.

The CVSS score of 9.8 signals critical severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly known exploits at the time of the advisory. Nonetheless the attack can be carried out remotely over the network by sending a single crafted HTTP request containing the malicious Sec-WebSocket-Key header. Because authentication is not required and the vulnerability depends only on the HTTP server being active, the risk of exploitation is high, with the potential outcome of denial of service or arbitrary code execution.