Vulnerabilities in zephyrproject
206 resultsCVE-2026-13214CRITICALStack buffer overflow in OCPP GetConfiguration key parsingEPSS 0.9%CVE-2026-8023HIGHPath traversal in Zephyr HTTP server static-filesystem resource handler allows unauthenticated remote arbitrary file readEPSS 0.9%CVE-2026-13217MEDIUMNULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoiEPSS 0.7%CVE-2026-10666HIGHStack buffer overflow in `net_ipaddr_parse()` IPv4 address-with-port parsing in `subsys/net/ip/utils.c`EPSS 0.7%CVE-2026-10686MEDIUMMissing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routersEPSS 0.6%CVE-2026-10665HIGHHeap buffer overflow on WireGuard receive path via unbounded incoming packet lengthEPSS 0.6%CVE-2026-10672HIGHUnterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)EPSS 0.6%CVE-2026-15891HIGHNULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gatewayEPSS 0.6%CVE-2026-10849HIGHHeap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response bodyEPSS 0.5%CVE-2026-12233MEDIUMUninitialized mutex in TLS trusted-credential backend causes kernel NULL-deref DoS under contentionEPSS 0.5%CVE-2026-11810HIGHNULL-pointer dereference in UpdateHub OTA agent on empty inner metadata array (remote DoS)EPSS 0.5%CVE-2026-15892MEDIUMHeap memory leak in mcumgr settings-management handlers on access-hook rejection leads to denial of serviceEPSS 0.5%CVE-2026-10646HIGHUse-after-return in `zsock_getaddrinfo()` when a timed-out DNS query is retried without cancellationEPSS 0.4%CVE-2026-10653MEDIUMNon-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unrefEPSS 0.4%CVE-2026-10673HIGHOut-of-bounds write in ADIN2111/ADIN1110 OA SPI Ethernet RX frame reassemblyEPSS 0.4%CVE-2026-10652MEDIUMOut-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)EPSS 0.4%CVE-2026-15924MEDIUMUse-after-free / double-free from unsynchronized concurrent access to the TLS client session cache in Zephyr socketsEPSS 0.4%CVE-2026-11811LOWSocket file-descriptor leak in UpdateHub OTA client start_coap_client() leading to resource-exhaustion DoSEPSS 0.4%CVE-2026-10657LOWOut-of-bounds read in Zephyr DNS resolver mDNS suffix check (memcmp past string NUL)EPSS 0.4%CVE-2026-13343MEDIUMUninitialised stack memory disclosure in the MIDI 2.0 UMP Stream responderEPSS 0.4%