CVE-2026-90588 Out-of-bounds read in Zephyr HTTP client debug logging of response header fields

The HTTP client's debug helper printheaderfield in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not...

CVE-2026-90588 Out-of-bounds read in Zephyr HTTP client debug logging of response header fields

The HTTP client's debug helper printheaderfield in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not...

EUVD-2026-120489

The HTTP client's debug helper printheaderfield in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not...

PT-2026-141164

The HTTP client's debug helper print header field in subsys/net/lib/http/http client.c formatted an http parser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are...

CVE-2026-90588: zephyrproject zephyr: The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser…

The HTTP client's debug helper printheaderfield in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintkoutput, len + 1, "%s", str. The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not...