Description

CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-11T21:17:35.507Z",
  "pubdate": "2026-08-11T21:17:35.507Z",
  "executiveSummary": "CivetWeb commit 4a4f0c95 contains a critical heap and stack buffer overflow vulnerability residing within the read_websocket() function.\nThe vulnerability is triggered when both the USE_ZLIB and MG_EXPERIMENTAL_INTERFACES compilation flags are defined, exposing systems to memory corruption, denial of service, and potential remote code execution.\nUnauthenticated remote attackers can leverage this flaw by negotiating the permessage-deflate extension during the initial WebSocket handshake and subsequently transmitting a crafted compressed WebSocket frame with the RSV1 bit set.\nUpon receiving the malicious frame, the server attempts to write a 4-byte zlib sync trailer out-of-bounds past the boundary of the allocated buffer.\nThis out-of-bounds write directly corrupts adjacent heap metadata, posing severe security implications for affected deployments exposed to untrusted networks.",
  "technicalDetails": "The vulnerability originates in the read_websocket() function of CivetWeb commit 4a4f0c95 when the server is built with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES preprocessor definitions enabled.\nThe attack vector requires network exposure where unauthenticated remote attackers can establish a WebSocket connection with the vulnerable server.\nDuring the WebSocket handshake phase, the attacker successfully negotiates the permessage-deflate extension.\nFollowing the handshake, the attacker transmits a specially crafted WebSocket frame containing the RSV1 bit set, which signals the use of compression.\nWhen processing this frame, the server-side logic improperly calculates bounds or fails to adequately validate the destination buffer size when handling the compressed payload.\nAs a direct result, the implementation appends or writes a 4-byte zlib sync trailer past the end of the allocated heap or stack buffer.\nThis out-of-bounds write corrupts adjacent heap metadata structures or stack frames, leading to unpredictable application behavior.\nDepending on heap layout and exploitation reliability, the resulting memory corruption can be leveraged by an attacker to trigger a denial of service via application crashes or potentially achieve arbitrary remote code execution within the context of the running CivetWeb process."
}