CVE-2026-11811

The CVE-2026-11811 entry documents a socket-file-descriptor leak in the UpdateHub OTA client (start_coap_client) when connection-setup fails. The leak occurs because on failure paths the cleanup gate does not call cleanup_connection(), leaving an open descriptor in the global ctx.sock that is ove...

CVE-2026-11809

CVE-2026-11809 (Zephyr UpdateHub OTA client) : The UpdateHub probe in subsys/mgmt/updatehub/updatehub.c uses a second heap buffer (metadata_copy) via memcpy(metadata_copy, metadata, strlen(metadata)) without zeroing. This omits the terminating NUL, so a subsequent json_obj_parse(metadata_copy, st...

CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...

CVE-2026-10849 Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body

The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in responsejsoncb subsys/mgmt/hawkbit/hawkbit.c. The buffer is sized to hold the received body bytes but reserves no space for a terminating NUL. When the...