CVE-2026-29035
CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.
- Score
- CVSS 4.0 8.3 High
- Status
- Awaiting Analysis - disclosure@vulncheck.com
- Published
- 2026-08-11
- Last modified
- 2026-08-14
- Weaknesses
- CWE-787
Affected products
References
- https://github.com/civetweb/civetweb
- https://www.vulncheck.com/advisories/civetweb-heap-stack-buffer-overflow-via-websocket-permessage-deflate-decompression
