External risk intelligence

Zephyr HTTP/2 Remote Memory Corruption Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-82391

The vulnerability affects an HTTP/2 server implementation within the Zephyr RTOS. Because this server is intended to handle network requests, including those for static files, it is commonly exposed as a network-facing service in embedded deployments such as IoT devices, gateways, or management interfaces that listen for incoming HTTP connections.

Out-of-bounds Write

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the Zephyr HTTP server's handling of HTTP/2 connections. The issue arises from an improper management of connection receive states, which could allow an unauthenticated attacker to cause remote memory corruption. At a minimum, this could lead to a server crash or hang, and potentially enable code execution.

Unauthenticated attackers can corrupt server memory.
Enables remote code execution or denial of service.
Confirm relevance and potential exposure to this server.

Attack Path

How an attacker could exploit the issue

An attacker can target the Zephyr HTTP server's handling of HTTP/2 connections. By sending a specially crafted GET request for a static file, an attacker can manipulate the server's internal buffer size counter. This manipulation allows the server to read and write data beyond the intended buffer boundaries, potentially corrupting memory and leading to code execution.

Unauthenticated network access required.
Triggered by requesting a static file.
Risk of remote memory corruption.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect system data and service behavior by allowing an unauthenticated attacker to trigger memory corruption in the server's address space when an HTTP/2 GET request is made for a static file. This is possible when the Zephyr HTTP server is configured with static filesystem resources and the HTTP version 2 is enabled without TLS or credentials.

Server memory could be corrupted.
An attacker could send crafted HTTP/2 requests.
The server could crash or execute code.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Zephyr RTOS HTTP/2 server implementation is likely managed by embedded systems or IoT platform teams, with potential oversight from application owners if the server is part of a specific product. The immediate priority is to inventory all instances of the Zephyr HTTP server, confirm exposure and business criticality, and identify the responsible team for remediation planning.

Identify affected Zephyr RTOS instances.
Verify server exposure and criticality.
Plan remediation with responsible teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Zephyr HTTP server?

The Zephyr HTTP server is a network component within the Zephyr Real-Time Operating System (RTOS). It provides built-in capabilities for embedded devices, such as IoT hardware or industrial gateways, to serve web content or host management interfaces. This vulnerability specifically affects the server's HTTP/2 implementation when it is configured to host static files from the device's filesystem.

How does this vulnerability cause memory corruption?

The weakness is classified as CWE-787 (Out-of-bounds Write). The server incorrectly updates an internal buffer counter using the size of a requested file rather than the available buffer space. This allows an attacker to bypass memory safety limits, causing the server to overwrite adjacent memory regions, which can lead to system crashes or, in some cases, the execution of unauthorized code.

What triggers this memory corruption bug?

An attacker triggers the bug by sending an unauthenticated HTTP/2 GET request for any static file hosted by the server. It is important to note that this flaw specifically impacts the HTTP/2 handler; the HTTP/1 and HTTP/3 handlers use a different, safer method for file processing and are not affected by this specific issue.

How do I know if my device is at risk?

According to Halo Surface Signal, this vulnerability is most relevant to devices where the Zephyr HTTP server is network-facing, such as IoT devices or gateways listening for incoming HTTP connections. If your device uses Zephyr with HTTP/2 enabled and static file serving configured, it is considered potentially exposed to unauthenticated network access.

What steps should I take if I use this software?

Begin by auditing your firmware to determine if your application uses the Zephyr HTTP server with HTTP/2 and static filesystem resources enabled. Once identified, evaluate the necessity of these services and coordinate with your development or maintenance teams to plan for an update to a patched version of the Zephyr RTOS that resolves this memory management defect.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.