{"id":"CVE-2026-82391","summary":"Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length","details":"The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/http_server_http2.c, handle_http2_static_fs_resource() passed &client-\u003edata_len as the file_size out-parameter of http_server_find_file(). client-\u003edata_len is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client-\u003ebuffer[CONFIG_HTTP_SERVER_CLIENT_BUFFER_SIZE] (256 bytes by default), an invariant every frame handler and the socket receive path rely on. Serving any static file therefore replaced that bounded value with the file's on-disk size, and nothing resets it afterwards.\n\nThe defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, in applications that register a static-filesystem resource (HTTP_RESOURCE_TYPE_STATIC_FS) with CONFIG_FILE_SYSTEM=y; CONFIG_HTTP_SERVER_VERSION_2 is enabled by default and no TLS or credentials are required on this path. Once client-\u003edata_len exceeds the buffer size, the frame dispatch loop in subsys/net/lib/http/http_server_core.c keeps parsing past the end of the received data, and the peer controls the bytes at client-\u003ecursor, so it can choose which fabricated frame the state machine consumes next by appending bytes after its request.\n\nThe inflated length defeats the only guards on the buffer. parse_http_frame_header() and the per-frame handlers read and skip up to a 24-bit frame length beyond the buffer (out-of-bounds read); the compaction memmove(client-\u003ebuffer, client-\u003ecursor, client-\u003edata_len) at the end of request handling copies the file-size number of bytes into the 256-byte buffer, overflowing the rest of struct http_client_ctx — including the current_detail/current_stream pointers, the parser_settings function-pointer table and the inactivity_timer work handler — and the adjacent client contexts in static memory; and the subsequent zsock_recv(client-\u003efd, client-\u003ebuffer + client-\u003edata_len, sizeof(client-\u003ebuffer) - client-\u003edata_len, 0) underflows its size argument, writing attacker-supplied data of attacker-chosen length out of bounds.\n\nThe impact is remote memory corruption in the server's single address space: at minimum a crash or hang of the device, and plausibly control-data overwrite leading to code execution. The HTTP/1 and HTTP/3 static-filesystem handlers already used a local variable and are unaffected; the fix makes the HTTP/2 handler use a local size_t file_size as well.","aliases":["GHSA-8jrg-wx88-g75j"],"modified":"2026-11-11T13:25:19.331133886Z","published":"2026-11-10T22:07:39.047Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82391.json","cna_assigner":"zephyr","cwe_ids":["CWE-787"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/82xxx/CVE-2026-82391.json"},{"type":"PACKAGE","url":"https://github.com/zephyrproject-rtos/zephyr"},{"type":"FIX","url":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29"},{"type":"ADVISORY","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-8jrg-wx88-g75j"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82391"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zephyrproject-rtos/zephyr","events":[{"introduced":"8469084dfae85f854555f0607f2c838dad097235"},{"fixed":"28af05ca658cbacf745fd5b099566311c58ccb1d"},{"introduced":"684c9e8f32e4373a21098559f748f06915f950c9"},{"fixed":"41d10b59730406bbab4ca9f1fbbe9e96aafb4966"},{"fixed":"4e0a5f38b14dba5891fb558c49a526f9f6a3cc29"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"4.0.0"},{"fixed":"4.3.2"}],"source":"AFFECTED_FIELD"},{"strategy":"StandardRange","range":[{"introduced":"4.4.0"},{"fixed":"4.5.0"}],"source":"AFFECTED_FIELD"},{"range":[{"fixed":"4e0a5f38b14dba5891fb558c49a526f9f6a3cc29"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["v4.3.1","v4.3.1-rc1","v4.4.0","v4.3.0","v4.3.0-rc3","v4.3.0-rc2","v4.3.0-rc1","v4.2.0","v4.2.0-rc3","v4.2.0-rc2","v4.2.0-rc1","v4.1.0","v4.1.0-rc3","v4.1.0-rc2","v4.1.0-rc1","v4.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-82391.json","vanir_signatures":[{"digest":{"function_hash":"96353323809734983777847158738994580425","length":2339},"id":"CVE-2026-82391-202e3164","signature_type":"Function","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29","target":{"file":"subsys/net/lib/http/http_server_http2.c","function":"handle_http2_static_fs_resource"},"deprecated":false},{"id":"CVE-2026-82391-706f02a2","signature_type":"Line","signature_version":"v1","source":"https://github.com/zephyrproject-rtos/zephyr/commit/4e0a5f38b14dba5891fb558c49a526f9f6a3cc29","target":{"file":"subsys/net/lib/http/http_server_http2.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["331692616837336972599785128611646034949","260623531537493707532267351409005993642","18818221601573250247411496270655769857","308408105724144282773669065855376840152","87762761422018736715924864930395315827","234347326583590443185872953237463286428","252575363533289693373843599634549722435","267674360358781166785226984046099484572","268061566255039288647723987588808641108","72663869987188859900253768142706743234","118946166383827959429370400391752725424","17708829465746509409391368135409961996","170343655114912040971039772558541815454","47535072411875479813687998956482112336","338974072496433971192570751942242052744"]}}],"vanir_signatures_modified":"2026-11-11T13:25:19Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}]}