Zephyrproject-rtos vulnerabilities
127 CVEs and advisories name Zephyrproject-rtos as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-13351net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets
- CVE-2026-5068bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data
- CVE-2026-5067Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
- CVE-2026-5066net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function
- CVE-2026-5589Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.
- CVE-2026-5071can: Local Denial of Service via SocketCAN Send
- CVE-2026-5072ptp: Potential Denial of Service via PTP Interval Shift
- CVE-2026-1681net: Stack Overflow with Ping (to own IP Address) via Shell
- CVE-2026-1677net: TLS 1.2 connections allowed on TLS 1.3 sockets
- CVE-2026-5590net: ip/tcp: Null pointer dereference can be triggered by a race condition
- CVE-2026-1679net: eswifi socket send payload length not bounded
- CVE-2026-4179stm32: usb: Infinite while loop in Interrupt Handler
- CVE-2026-0849crypto: ATAES132A response length allows stack buffer overflow
- CVE-2026-1678dns: memory‑safety issue in the DNS name parser
- CVE-2025-12899net: icmp: Out of bound memory read
- CVE-2025-12035Bluetooth: Integer Overflow in Bluetooth Classic (BR/EDR) L2CAP
- CVE-2025-9557Bluetooth: Mesh: Out-of-Bound Write in gen_prov_cont
- CVE-2025-9558Bluetooth: Mesh: Out-of-Bound Write in gen_prov_start
- CVE-2025-9408Userspace privilege escalation vulnerability on Cortex M
- CVE-2025-12890Bluetooth: peripheral: Invalid handling of malformed connection request
- CVE-2025-10456Bluetooth: Semi-Arbitrary ability to make the BLE Target send disconnection requests
- CVE-2025-10458Bluetooth: le_conn_rsp does not sanitize CID, MTU, MPS values
- CVE-2025-7403Bluetooth: bt_conn_tx_processor unsafe handling
- CVE-2025-10457Bluetooth: Out-Of-Context le_conn_rsp Handling
- CVE-2025-2962Infinite loop in dns_copy_qname
- CVE-2025-1675Out of bounds read in dns_copy_qname
- CVE-2025-1674Out of bounds read when unpacking DNS answers
- CVE-2025-1673Out of bounds read when calling crc16_ansi and strlen in dns_validate_msg
- CVE-2024-10395net: lib: http_server: Buffer Under-read
- CVE-2024-8798Bluetooth: classic: avdtp: missing buffer length check