Zephyr RTOS: High-Severity TLS Flaw and UpdateHub Issues Disclosed Together
Four vulnerabilities, including a high-severity TLS/DTLS flaw, were disclosed for the Zephyr RTOS on August 10, 2026, impacting its networking and OTA update capabilities.
Key findings
- High-severity TLS/DTLS vulnerability (CVE-2026-8718) disclosed for Zephyr RTOS.
- Three lower-severity issues affect the Zephyr UpdateHub OTA client (CVE-2026-11810, CVE-2026-11811, CVE-2026-11809).
- Vulnerabilities disclosed together on August 10, 2026, within a two-hour window.
- Issues include buffer overflows, improper validation, and resource leaks in network and update components.
On August 10, 2026, a batch of four vulnerabilities was disclosed for the Zephyr RTOS, with a high-severity flaw impacting its TLS/DTLS implementation and three lower-severity issues related to the UpdateHub over-the-air (OTA) update client. The disclosures occurred within a two-hour window, highlighting potential risks for embedded systems relying on Zephyr for secure communication and updates.
Two of the vulnerabilities, CVE-2026-8718 and CVE-2026-11810, were rated as High severity. CVE-2026-8718, found in subsyst/net/lib/sockets/sockets_tls.c, stems from insufficient buffer size verification in the tls_opt_dtls_peer_connection_id_value_get() function when handling DTLS peer connection IDs. This could allow an attacker to write beyond the allocated buffer, potentially leading to a denial-of-service or code execution. CVE-2026-11810, located in the UpdateHub client's probe handler (subsyst/mgmt/updatehub/updatehub.c), involves improper validation of JSON metadata parsed from an update server. An attacker could exploit this by sending malformed metadata, leading to a crash or potential code execution by dereferencing an invalid array index.
The remaining two vulnerabilities, CVE-2026-11811 and CVE-2026-11809, are rated as Low severity. CVE-2026-11811, also in the UpdateHub client, involves a socket descriptor leak on connection setup failure paths, which could potentially be used in resource exhaustion attacks. CVE-2026-11809, another issue within the UpdateHub client's probe function, contains an out-of-bounds read due to incorrect buffer allocation and copying of the probe response, which could lead to information disclosure or a crash.
The vulnerabilities were disclosed by the Zephyrproject RTOS security team. As of the disclosure, there is no immediate information regarding active exploitation in the wild for any of these CVEs. Users of the Zephyr RTOS are advised to review the specific affected versions and apply patches as they become available. The UpdateHub client issues suggest a need for careful validation of external data, especially in OTA update mechanisms.
The disclosed vulnerabilities underscore the importance of robust security practices in embedded systems, particularly concerning network communications and update processes. The high-severity flaw in the TLS/DTLS implementation is a critical concern for any system relying on secure network connections. Developers using Zephyr should prioritize updating to patched versions to mitigate these risks. Further details and specific mitigation guidance can be found in the official Zephyrproject security advisories.
The batch of vulnerabilities, disclosed on August 10, 2026, includes a critical flaw in Zephyr's TLS/DTLS handling and several issues within its UpdateHub OTA client. The high-severity CVE-2026-8718 impacts secure communication, while CVEs CVE-2026-11810, CVE-2026-11811, and CVE-2026-11809 affect the integrity and security of the UpdateHub client. These disclosures highlight the ongoing need for vigilance in securing embedded systems.
The specific functions and files affected are:
tls_opt_dtls_peer_connection_id_value_get()insubsyst/net/lib/sockets/sockets_tls.c(CVE-2026-8718)start_coap_client()andzsockinsubsyst/mgmt/updatehub/updatehub.c(CVE-2026-11811)z_impl_updatehub_probe()insubsyst/mgmt/updatehub/updatehub.c(CVE-2026-11810, CVE-2026-11809)
Users should consult the Zephyrproject RTOS advisories for detailed information on affected versions and available patches.