{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/zephyrproject-rtos/zephyr","packageName":"zephyr","product":"zephyr","source":"CNA: zephyr","vendor":"zephyrproject","versions":[{"lessThan":"4.3.2","status":"affected","version":"4.1.0","versionType":"semver"},{"lessThan":"4.5.0","status":"affected","version":"4.4.0","versionType":"semver"}]},{"ecosystem":"other","packageName":"zephyr","product":"zephyr","source":"GitHub GHSA-cw8r-2jj2-w8fw","vendor":"","versions":[{"status":"affected","version":">= 4.1.0, < 4.3.2","versionType":"GitHub advisory range"}]},{"ecosystem":"other","packageName":"zephyr","product":"zephyr","source":"GitHub GHSA-cw8r-2jj2-w8fw","vendor":"","versions":[{"status":"affected","version":">= 4.4.0, < 4.5.0","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-87045","cwes":["CWE-476"],"description":"The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of every frame. handle_http_frame_header() executed client->current_stream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enter_http_frame_continuation_state() never re-bound one, so the rest of the header block was processed with client->current_stream unset. Two paths then write through the NULL pointer. A request for an unregistered resource, or a method the matched resource does not support, is answered by send_http2_404() or send_http2_405(), and both call send_headers_frame(), which unconditionally sets client->current_stream->headers_sent = true. A POST, PUT or PATCH to a registered dynamic resource reaches handle_http2_dynamic_resource(), which unlike its siblings (handle_http2_static_resource(), dynamic_get_del_opts_req_v2(), dynamic_post_put_req_v2()) had no client->current_stream == NULL guard, and stores through the pointer with client->current_stream->current_detail = dynamic_detail.\n\nAny peer that can reach the server can trigger this without authentication or prior state. A single stray CONTINUATION frame with END_HEADERS set, sent right after the client preface and requesting any unregistered path, is enough, because nothing rejected a CONTINUATION that no HEADERS frame had opened. A legitimate split header block (a HEADERS frame with END_HEADERS clear whose payload ends on a header-field boundary, then a CONTINUATION with END_HEADERS set) reaches the same state. The in-tree test test_http2_post_headers_with_continuation() did not catch this because it splits the header block mid field, which takes the handle_incomplete_http_header() shortcut that keeps the stream bound.\n\nThe result is a write to a fixed low address (a small offset into struct http2_stream_ctx), which faults on mainstream targets (flash/vector-table region on Cortex-M, or a trap under MPU/MMU null-pointer detection), and the default fatal-error handler halts the system. Impact is an unauthenticated, remotely triggerable denial of service against any device running the HTTP/2 server: the 404 path needs no particular resource to be registered, and HTTP/2 is built into CONFIG_HTTP_SERVER with cleartext h2c accepted, so TLS does not prevent it. Neither the target address nor the written value is attacker-controlled, so there is no confidentiality or integrity impact. Applications built without CONFIG_HTTP_SERVER are not affected.","epss":{"date":"2026-11-10","percentile":0.32563,"score":0.00382},"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: zephyr","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},{"score":7.5,"severity":"high","source":"NVD: vulnerabilities@zephyrproject.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1794321720369,"publishedAt":1793975905629,"references":[{"source":"CNA: zephyr","tags":["patch"],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/e72a9d9498092bfbb7feed4b479bf21bc3218c3d"},{"source":"CNA: zephyr","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cw8r-2jj2-w8fw"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/commit/e72a9d9498092bfbb7feed4b479bf21bc3218c3d"},{"source":"vulnerabilities@zephyrproject.org","tags":[],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cw8r-2jj2-w8fw"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cw8r-2jj2-w8fw"}],"remediation":[{"kind":"fix","source":"CNA: zephyr","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/zephyrproject-rtos/zephyr/commit/e72a9d9498092bfbb7feed4b479bf21bc3218c3d"},{"kind":"fix","source":"GitHub GHSA-cw8r-2jj2-w8fw","text":"zephyr (other): GitHub reports patched versions 4.3.2. Check the advisory for the affected release branch.","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cw8r-2jj2-w8fw"},{"kind":"fix","source":"GitHub GHSA-cw8r-2jj2-w8fw","text":"zephyr (other): GitHub reports patched versions 4.5.0. Check the advisory for the affected release branch.","url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cw8r-2jj2-w8fw"}],"revision":"f44027b446e990976e033d249e89d29735096c784ef438f588a11596a39dbdb2","sources":[{"modifiedAt":1794321720369,"name":"CNA: zephyr","retrievedAt":1794323477456,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87045"},{"modifiedAt":1793978247010,"name":"NVD","retrievedAt":1793990207133,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87045"},{"modifiedAt":1793975815000,"name":"GitHub Security Advisories","retrievedAt":1794123609518,"url":"https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cw8r-2jj2-w8fw"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794323481108,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87045"}],"ssvc":{"assessedAt":1794321708004,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame","updatedAt":1794323481108}