Zephyr
Source repositories
CVEs (198)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-3806 | Cri | 0.64 | 9.8 | 0.01 | Jan 25, 2023 | Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer. | ||
| CVE-2018-1000800 | Cri | 0.64 | 9.8 | 0.02 | Sep 6, 2018 | zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs… | ||
| CVE-2021-3625 | Cri | 0.63 | 9.6 | 0.02 | Oct 5, 2021 | Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3gr-hgvr-f363 | ||
| CVE-2021-3329 | Cri | 0.62 | 9.6 | 0.01 | Feb 26, 2023 | Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack | ||
| CVE-2023-0397 | Cri | 0.62 | 9.6 | 0.00 | Jan 19, 2023 | A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete. | ||
| CVE-2021-3966 | Cri | 0.62 | 9.6 | 0.00 | Jan 11, 2023 | usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem. | ||
| CVE-2026-1678 | Cri | 0.61 | 9.4 | 0.00 | Mar 5, 2026 | dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can… | ||
| CVE-2024-11263 | Cri | 0.60 | 9.3 | 0.00 | Nov 15, 2024 | When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols. | ||
| CVE-2020-13601 | Cri | 0.59 | 9.0 | 0.01 | May 25, 2021 | Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44 | ||
| CVE-2026-5067 | Cri | 0.57 | 9.8 | 0.01 | Jun 9, 2026 | A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bounded copy that does not guarantee NUL… | ||
| CVE-2024-10395 | Hig | 0.56 | 8.6 | 0.00 | Feb 3, 2025 | No proper validation of the length of user input in http_server_get_content_type_from_extension. | ||
| CVE-2023-7060 | Hig | 0.56 | 8.6 | 0.00 | Mar 15, 2024 | Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address. | ||
| CVE-2023-4258 | Hig | 0.56 | 8.6 | 0.00 | Sep 25, 2023 | In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee. | ||
| CVE-2022-2993 | Hig | 0.56 | 8.6 | 0.01 | Dec 9, 2022 | There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. | ||
| CVE-2023-5055 | Hig | 0.54 | 8.3 | 0.01 | Nov 21, 2023 | Possible variant of CVE-2021-3434 in function le_ecred_reconf_req. | ||
| CVE-2023-4424 | Hig | 0.54 | 8.3 | 0.00 | Nov 21, 2023 | An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device. | ||
| CVE-2021-3323 | Hig | 0.54 | 8.3 | 0.01 | Oct 12, 2021 | Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions >= >=2.4.0 contain Integer Underflow (Wrap or Wraparound) (CWE-191). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc | ||
| CVE-2020-10064 | Hig | 0.54 | 8.3 | 0.01 | May 25, 2021 | Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gv… | ||
| CVE-2026-10672 | Hig | 0.53 | 8.2 | 0.00 | Jul 14, 2026 | subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no… | ||
| CVE-2026-7656 | Hig | 0.53 | 8.1 | 0.00 | Jun 29, 2026 | The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was… |
- risk 0.64cvss 9.8epss 0.01
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
- risk 0.64cvss 9.8epss 0.02
zephyr-rtos version 1.12.0 contains a NULL base pointer reference vulnerability in sys_ring_buf_put(), sys_ring_buf_get() that can result in CPU Page Fault (error code 0x00000010). This attack appear to be exploitable via a malicious application call the vulnerable kernel APIs…
- risk 0.63cvss 9.6epss 0.02
Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >= v2.5.0 contain Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-c3gr-hgvr-f363
- risk 0.62cvss 9.6epss 0.01
Lack of proper validation in HCI Host stack initialization can cause a crash of the bluetooth stack
- risk 0.62cvss 9.6epss 0.00
A malicious / defect bluetooth controller can cause a Denial of Service due to unchecked input in le_read_buffer_size_complete.
- risk 0.62cvss 9.6epss 0.00
usb device bluetooth class includes a buffer overflow related to implementation of net_buf_add_mem.
- risk 0.61cvss 9.4epss 0.00
dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can…
- risk 0.60cvss 9.3epss 0.00
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
- risk 0.59cvss 9.0epss 0.01
Possible read out of bounds in dns read. Zephyr versions >= 1.14.2, >= 2.3.0 contain Out-of-bounds Read (CWE-125). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-mm57-9hqw-qh44
- risk 0.57cvss 9.8epss 0.01
A remote, unauthenticated attacker can trigger memory corruption in Zephyr's HTTP server WebSocket upgrade path by sending a crafted Sec-WebSocket-Key header. The HTTP/1 header parser copies the header into a fixed-size buffer using a bounded copy that does not guarantee NUL…
- risk 0.56cvss 8.6epss 0.00
No proper validation of the length of user input in http_server_get_content_type_from_extension.
- risk 0.56cvss 8.6epss 0.00
Zephyr OS IP packet handling does not properly drop IP packets arriving on an external interface with a source address equal to 127.0.01 or the destination address.
- risk 0.56cvss 8.6epss 0.00
In Bluetooth mesh implementation If provisionee has a public key that is sent OOB then during provisioning it can be sent back and will be accepted by provisionee.
- risk 0.56cvss 8.6epss 0.01
There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet.
- risk 0.54cvss 8.3epss 0.01
Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.
- risk 0.54cvss 8.3epss 0.00
An malicious BLE device can cause buffer overflow by sending malformed advertising packet BLE device using Zephyr OS, leading to DoS or potential RCE on the victim BLE device.
- risk 0.54cvss 8.3epss 0.01
Integer Underflow in 6LoWPAN IPHC Header Uncompression in Zephyr. Zephyr versions >= >=2.4.0 contain Integer Underflow (Wrap or Wraparound) (CWE-191). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-89j6-qpxf-pfpc
- risk 0.54cvss 8.3epss 0.01
Improper Input Frame Validation in ieee802154 Processing. Zephyr versions >= v1.14.2, >= v2.2.0 contain Stack-based Buffer Overflow (CWE-121), Heap-based Buffer Overflow (CWE-122). For more information, see https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-3gv…
- risk 0.53cvss 8.2epss 0.00
subsys/net/lib/lwm2m/lwm2m_pull_context.c copied the firmware-update Package URI into a fixed static buffer (context.uri, size CONFIG_LWM2M_SWMGMT_PACKAGE_URI_LEN, default 128) with memcpy(context.uri, uri, LWM2M_PACKAGE_URI_LEN), copying exactly the destination size with no…
- risk 0.53cvss 8.1epss 0.00
The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was…
Page 1 of 10