CVE-2026-82391

The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output.

The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client->data_len as the file_size out-parameter of http_server_find_file(). client->data_len is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client->buffer[CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE] (256 bytes by default), an invariant every frame…

10. Nov 2026

Ausgewertete Quellen

• NVD
  CVE-2026-82391