CVE-2026-29035
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Summary
CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| civetweb | civetweb | 0 <= 4a4f0c95 | affected |
Weaknesses
- CWE-787: Out-of-bounds Write
References
- https://github.com/civetweb/civetweb
- https://www.vulncheck.com/advisories/civetweb-heap-stack-buffer-overflow-via-websocket-permessage-deflate-decompression
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.