CVE-2026-15924

Zephyr's TLS socket layer in subsys/net/lib/sockets/socketstls.c keeps a single process-global array, clientcache, of cached client sessions that is shared by every TLS socket context. The functions that mutate and read it — tlssessionsave, tlssessionget, tlssessioncachereset, and the settings...

CVE-2026-15924

Zephyr RTOS TLS socket layer contains a use-after-free and double-free vulnerability in the process-global client_cache array shared across all TLS socket contexts. The root cause is that the per-socket mutex (ctx->lock) provides no mutual exclusion between different sockets concurrently acces...

EUVD-2026-77767

netifipv6calcreachabletime in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6-basereachabletime as minreachable + sysrand32get % maxreachable - minreachable, where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both...

CVE-2026-15893 Zephyr IPv6 Neighbor Discovery zero reachable time from crafted Router Advertisement causes assertion/DoS

netifipv6calcreachabletime in subsys/net/ip/netif.c derives a randomized ND reachable time from ipv6-basereachabletime as minreachable + sysrand32get % maxreachable - minreachable, where minreachable = base/2 and maxreachable = 3base/2 using integer division. When basereachabletime is 1, both...

CVE-2026-15893

CVE-2026-15893 affects the Zephyr RTOS IPv6 Neighbor Discovery stack. The function net_if_ipv6_calc_reachable_time() in subsys/net/ip/net_if.c computes a randomized reachable time from base_reachable_time using integer division. When the Reachable Time field of an incoming Router Advertisement is...

vulns

漏洞报告 HN Security 的安全公告。 https://hnsecurity.it/ Solaris HNS-2022-01-dtprintinfo. Solaris dtprintinfo 与 libXm/libXpm 中的多个漏洞（CVE-2022-46285、CVE-2023-24039、CVE-2023-24040）。 Zyxel HNS-2022-02-zyxel-zysh. Zyxel zysh 中的多个漏洞（CVE-2022-26531、CVE-2022-26532）。 HNS-2025-10-zyxel-fermion. Zyxel uOS...

zephyr_cve-2021-3625

CVE-2021-3625 本仓库包含针对 CVE-2021-3625 的几个示例漏洞利用。 所有基于 Zephyr 的 USB 设备，直至（含）2.5.0 版本，均存在 缓冲区溢出漏洞，允许读取最多 65kB 数据。根据实际设备的不同， 这可能导致敏感数据（如加密密钥或凭据）泄露。 该问题可通过发出特制的 USB 控制传输请求来触发， 请求方向为 IN（读取，至主机），并带有特定的写入请求——例如 设置地址（0x05）。在这种情况下，向主机的写入并非预期操作，因此响应 长度不会更新，导致 request-wLength 保持初始设置值。 由于 wLength...

advisories

安全公告 “测试可以证明缺陷的存在，但无法证明其不存在。” -- Edsger W. Dijkstra 这是我公开发布的安全公告合集。 另请参阅 https://github.com/hnsecurity/vulns https://hnsecurity.it/blog/author/marco-ivaldi/ 安全公告 Linux CVE-2006-1242. Linux 内核 IP ID 信息泄露弱点。 OpenSSH 2003-01-openssh. OpenSSH/PAM 延迟信息泄露漏洞（CVE-2003-0190）。 CVE-2006-5229. OpenSSH...

zephyr

.. raw:: html Zephyr 项目是一个可扩展的实时操作系统（RTOS），支持多种硬件架构，针对资源受限设备进行了优化，并且在设计之初就考虑到了安全性。 Zephyr OS 基于一个小体积内核，专为资源受限系统设计：从简单的嵌入式环境传感器和 LED 可穿戴设备，到复杂的智能手表和物联网无线网关。 Zephyr 内核支持多种架构，包括 ARM（Cortex-A、Cortex-R、Cortex-M）、Intel x86、ARC、Tensilica Xtensa、RISC-V、SPARC、MIPS，以及大量 支持的开发板。 .. below included in...

EUVD-2026-77132

The MQTT-SN client keepalive handler processping in subsys/net/lib/mqttsn/mqttsn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYSSLISTPEEKHEADCONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign to gw, s...

PT-2026-90983

The MQTT-SN client keepalive handler process ping in subsys/net/lib/mqtt sn/mqtt sn.c removes the gateway record after PINGREQ retries are exhausted. It invoked SYS SLIST PEEK HEAD CONTAINER&client-gateways, gw, next but discarded the result. That macro is a pure expression that does not assign t...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-15461 Type confusion in Zephyr HL78xx GNSS NMEA driver causes wild-pointer write from GNSS input

The Sierra Wireless HL78xx modem GNSS driver drivers/modem/hl78xx/, later drivers/modem/vendorstandalone/hl78xx/ embeds a generic struct gnssnmea0183matchdata matchdata inside struct hl78xxgnssdata. The generic NMEA0183 match helper drivers/gnss/gnssnmea0183match.c requires that context to be the...

CVE-2026-8023

CVE-2026-8023 — Zephyr HTTP static-fs 路径遍历（PoC） Zephyr HTTP 服务器 static-fs 处理器（subsys/net/lib/http）中的未认证路径遍历漏洞，当通配符资源匹配（CONFIGHTTPSERVERRESOURCEWILDCARD=y）与 HTTPRESOURCETYPESTATICFS 一起使用时触发。同时影响 HTTP/1.1 和 HTTP/2。 GHSA: GHSA-hch3-53g6-jj3h 受影响版本：= 4.0.0, = 4.4.0, 4.4.2...

CVE-2026-14697

netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...

EUVD-2026-68744

netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...

CVE-2026-14697 IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service

netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...

CVE-2026-14697 IPv6 Neighbor Solicitation packet leak causes TX pool exhaustion denial of service

netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...

CVE-2026-14696

When Ethernet bridging is enabled CONFIGNETETHERNETBRIDGE, ethbridgeinputprocess in subsys/net/l2/ethernet/bridge/bridgeinput.c decides how each frame received on a bridge member interface is handled. For frames that must also be delivered to the local stack, the code called ethbridgehandlelocall...

CVE-2026-14696

Zephyr RTOS Ethernet bridging contains an RX packet leak in eth_bridge_input_process() (subsys/net/l2/ethernet/bridge/bridge_input.c). When Ethernet bridging is enabled (CONFIG_NET_ETHERNET_BRIDGE), frames delivered to the local stack via eth_bridge_handle_locally() return NET_OK without actually...