Description
The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintf_complete.c uses strlen() when no precision is given, and lib/os/cbprintf_nano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte.

The slice reaches the helper from on_url(), on_header_field() and on_header_value(), which the parser invokes on bytes that http_wait_data() read straight off the socket into the application-supplied recv_buf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/http_client suite reproduces the over-read under CONFIG_ASAN=y on an ordinary GET.

The impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y, which the global CONFIG_LOG_DEFAULT_LEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region.

The fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.*s precision would not have sufficed, since cbprintf_nano.c measures the source in full before applying it).
Published: 2026-11-09
Score: 3.7 Low
EPSS: n/a
KEV: No
Impact: Out‑of‑bounds read that can crash the device during HTTP client debug logging
Action: Apply patch
AI Analysis

Impact

A malformed HTTP response can cause the Zephyr HTTP client’s debug helper to over‑read a header field because it uses a %s conversion on non‑NUL‑terminated data. The read can walk beyond the buffer, leading to a fault and a system panic. No user data is exposed, but the failure can abruptly halt the device.

Affected Systems

Devices running Zephyr where the HTTP client module is compiled with debug logging enabled (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y). The flaw does not affect default builds that have logging disabled. No specific version numbers are listed in the CNA data, so any release with this code path remains vulnerable unless fixed.

Risk and Exploitability

The CVSS score of 3.7 classifies the risk as low, and there is no EPSS value indicating common exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker could trigger the over‑read by sending a crafted HTTP response from a server that the client contacts, or by exploiting a compromised server that can respond to plaintext requests. The flaw does not provide remote code execution or information disclosure; it merely risks device instability.

Generated by OpenCVE AI on November 9, 2026 at 23:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Zephyr to a release that contains the patch that copies and NUL‑terminates header fields instead of using %s
  • If upgrading is not immediately possible, disable HTTP client debug logging by setting CONFIG_NET_HTTP_LOG_LEVEL_DBG to a value higher than Debug or removing the debug module entirely
  • Ensure that any code paths that trigger HTTP client responses are shielded from untrusted servers or otherwise confined so that a malicious server cannot reach the vulnerable buffer

Generated by OpenCVE AI on November 9, 2026 at 23:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Zephyrproject
Zephyrproject zephyr
Vendors & Products Zephyrproject
Zephyrproject zephyr

Mon, 09 Nov 2026 22:15:00 +0000

Type Values Removed Values Added
Description The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintf_complete.c uses strlen() when no precision is given, and lib/os/cbprintf_nano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte. The slice reaches the helper from on_url(), on_header_field() and on_header_value(), which the parser invokes on bytes that http_wait_data() read straight off the socket into the application-supplied recv_buf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/http_client suite reproduces the over-read under CONFIG_ASAN=y on an ordinary GET. The impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y, which the global CONFIG_LOG_DEFAULT_LEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region. The fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.*s precision would not have sufficed, since cbprintf_nano.c measures the source in full before applying it).
Title Out-of-bounds read in Zephyr HTTP client debug logging of response header fields
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 3.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Zephyrproject Zephyr
cve-icon MITRE

Status: PUBLISHED

Assigner: zephyr

Published:

Updated: 2026-11-09T22:04:00.483Z

Reserved: 2026-09-12T18:04:41.353Z

Link: CVE-2026-90588

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T23:30:18Z

Weaknesses