CVE-2026-90588

The Zephyr RTOS HTTP client contains an out-of-bounds read vulnerability in the debug helper function print_header_field() located in subsys/net/lib/http/http_client.c. The issue arises because the function uses a %s conversion with snprintk() on a data-callback slice that is not NUL-terminated. ...