CVE-2026-87045

A NULL pointer dereference exists in the Zephyr HTTP/2 server within subsys/net/lib/http/http_server_http2.c. The vulnerability occurs because handle_http_frame_header() unconditionally sets client->current_stream = NULL, but CONTINUATION frames do not re-bind the stream. This leads to a NULL ...

CVE-2026-87045 NULL pointer dereference in the Zephyr HTTP/2 server when a header block is completed by a CONTINUATION frame

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...

CVE-2026-87045: zephyrproject zephyr: The HTTP/2 server in subsys/net/lib/http/http_server_http2.c clears the connection's stream binding at the start of…

The HTTP/2 server in subsys/net/lib/http/httpserverhttp2.c clears the connection's stream binding at the start of every frame. handlehttpframeheader executed client-currentstream = NULL unconditionally, but a CONTINUATION frame does not open a new stream and enterhttpframecontinuationstate never...