CVE-2026-29035: CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression
CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the readwebsocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USEZLIB and MGEXPERIMENTALINTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29035?
CVE-2026-29035 has a medium severity rating of 6.5.
How do I fix CVE-2026-29035?
To mitigate CVE-2026-29035, update CivetWeb to a version that addresses the heap and stack buffer overflow vulnerability.
What type of attacks does CVE-2026-29035 allow?
CVE-2026-29035 allows unauthenticated remote attackers to exploit a buffer overflow vulnerability via malformed WebSocket frames.
What components of CivetWeb are affected by CVE-2026-29035?
CVE-2026-29035 affects the read_websocket() function specifically when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are enabled.
Is user interaction required to exploit CVE-2026-29035?
No, CVE-2026-29035 can be exploited without any user interaction as it targets unauthenticated access.