CVE-2026-82391: Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length

The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output. In subsys/net/lib/http/httpserverhttp2.c, handlehttp2staticfsresource() passed &client->datalen as the filesize out-parameter of httpserverfindfile(). client->datalen is the count of unprocessed bytes remaining in the fixed-size per-connection receive buffer client->buffer[CONFIGHTTPSERVERCLIENTBUFFERSIZE] (256 bytes by default), an invariant every frame handler and the socket receive path rely on. Serving any static file therefore replaced that bounded value with the file's on-disk size, and nothing resets it afterwards.

The defect is reached by an unauthenticated HTTP/2 GET for any file under the web root, in applications that register a static-filesystem resource (HTTPRESOURCETYPESTATICFS) with CONFIGFILESYSTEM=y; CONFIGHTTPSERVERVERSION2 is enabled by default and no TLS or credentials are required on this path. Once client->datalen exceeds the buffer size, the frame dispatch loop in subsys/net/lib/http/httpservercore.c keeps parsing past the end of the received data, and the peer controls the bytes at client->cursor, so it can choose which fabricated frame the state machine consumes next by appending bytes after its request.

The inflated length defeats the only guards on the buffer. parsehttpframeheader() and the per-frame handlers read and skip up to a 24-bit frame length beyond the buffer (out-of-bounds read); the compaction memmove(client->buffer, client->cursor, client->datalen) at the end of request handling copies the file-size number of bytes into the 256-byte buffer, overflowing the rest of struct httpclientctx — including the currentdetail/currentstream pointers, the parsersettings function-pointer table and the inactivitytimer work handler — and the adjacent client contexts in static memory; and the subsequent zsockrecv(client->fd, client->buffer + client->datalen, sizeof(client->buffer) - client->datalen, 0) underflows its size argument, writing attacker-supplied data of attacker-chosen length out of bounds.

The impact is remote memory corruption in the server's single address space: at minimum a crash or hang of the device, and plausibly control-data overwrite leading to code execution. The HTTP/1 and HTTP/3 static-filesystem handlers already used a local variable and are unaffected; the fix makes the HTTP/2 handler use a local sizet filesize as well.