Zephyr
Source repositories
CVEs (229)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-3806 | Cri | 0.64 | 9.8 | 0.01 | Jan 25, 2023 | Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer. | ||
| CVE-2017-14199 | Cri | 0.64 | 9.8 | 0.02 | Apr 12, 2019 | A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0. | ||
| CVE-2018-1000800 | Cri | 0.64 | 9.8 | 0.02 | Sep 6, 2018 | zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs… | ||
| CVE-2021-3625 | Cri | 0.63 | 9.6 | 0.02 | Oct 5, 2021 | Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3gr-hgvr-f363 | ||
| CVE-2021-3329 | Cri | 0.62 | 9.6 | 0.01 | Feb 26, 2023 | Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack | ||
| CVE-2023-0397 | Cri | 0.62 | 9.6 | 0.00 | Jan 19, 2023 | A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete. | ||
| CVE-2021-3966 | Cri | 0.62 | 9.6 | 0.00 | Jan 11, 2023 | usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. | ||
| CVE-2026-1678 | Cri | 0.61 | 9.4 | 0.00 | Mar 5, 2026 | dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can… | ||
| CVE-2024-11263 | Cri | 0.60 | 9.3 | 0.00 | Nov 15, 2024 | When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols. | ||
| CVE-2020-13601 | Cri | 0.59 | 9.0 | 0.01 | May 25, 2021 | Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44 | ||
| CVE-2020-10070 | Cri | 0.59 | 9.0 | 0.03 | Jun 5, 2020 | In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions. | ||
| CVE-2020-10062 | Cri | 0.59 | 9.0 | 0.03 | Jun 5, 2020 | An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions. | ||
| CVE-2026-5067 | Cri | 0.57 | 9.8 | 0.01 | Jun 9, 2026 | A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bounded copy that does not guarantee NUL… | ||
| CVE-2024-10395 | Hig | 0.56 | 8.6 | 0.00 | Feb 3, 2025 | No proper validation of the length of user input in http_server_get_content_type_from_extension. | ||
| CVE-2023-7060 | Hig | 0.56 | 8.6 | 0.00 | Mar 15, 2024 | Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address. | ||
| CVE-2023-4258 | Hig | 0.56 | 8.6 | 0.01 | Sep 25, 2023 | In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee. | ||
| CVE-2022-2993 | Hig | 0.56 | 8.6 | 0.01 | Dec 9, 2022 | There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. | ||
| CVE-2026-10673 | Hig | 0.54 | 8.3 | 0.00 | Jul 15, 2026 | The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size… | ||
| CVE-2023-5055 | Hig | 0.54 | 8.3 | 0.01 | Nov 21, 2023 | Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. | ||
| CVE-2023-4424 | Hig | 0.54 | 8.3 | 0.00 | Nov 21, 2023 | An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device. |
- risk 0.64cvss 9.8epss 0.01
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
- risk 0.64cvss 9.8epss 0.02
A buffer overflow has been found in the Zephyr Project's getaddrinfo() implementation in 1.9.0 and 1.10.0.
- risk 0.64cvss 9.8epss 0.02
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs…
- risk 0.63cvss 9.6epss 0.02
Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3gr-hgvr-f363
- risk 0.62cvss 9.6epss 0.01
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
- risk 0.62cvss 9.6epss 0.00
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
- risk 0.62cvss 9.6epss 0.00
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.
- risk 0.61cvss 9.4epss 0.00
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can…
- risk 0.60cvss 9.3epss 0.00
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
- risk 0.59cvss 9.0epss 0.01
Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44
- risk 0.59cvss 9.0epss 0.03
In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
- risk 0.59cvss 9.0epss 0.03
An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.
- risk 0.57cvss 9.8epss 0.01
A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bounded copy that does not guarantee NUL…
- risk 0.56cvss 8.6epss 0.00
No proper validation of the length of user input in http_server_get_content_type_from_extension.
- risk 0.56cvss 8.6epss 0.00
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
- risk 0.56cvss 8.6epss 0.01
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
- risk 0.56cvss 8.6epss 0.01
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
- risk 0.54cvss 8.3epss 0.00
The Zephyr ADIN2111/ADIN1110 10BASE-T1S/T1L Ethernet driver (drivers/ethernet/eth_adin2111.c) reassembles received Ethernet frames in OPEN Alliance (OA) SPI mode by copying device-supplied 64-byte data chunks into a fixed static buffer ctx->buf of size…
- risk 0.54cvss 8.3epss 0.01
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
- risk 0.54cvss 8.3epss 0.00
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
Page 1 of 12