CivetWeb CVE-2026-29035

Exploitation requires CivetWeb to be compiled with BOTH the USE_ZLIB preprocessor flag (enabling zlib decompression) AND the MG_EXPERIMENTAL_INTERFACES preprocessor flag (enabling experimental WebSocket extension negotiation including permessage-deflate); if either flag is absent at build time, the vulnerable code path is unreachable and exploitation is impossible regardless of network access. Given the CVSS 4.0 vector (PR:N, UI:N), no authentication is required and no user interaction is needed once a WebSocket connection can be established. The permessage-deflate extension must be successfully negotiated during the initial HTTP upgrade handshake, which requires the server to advertise support for it - a condition satisfied only under the above build configuration. Limiting factors are: the non-default dual compile-time flag requirement (MG_EXPERIMENTAL_INTERFACES by name signals experimental/non-production status), and the AC:H rating reflecting the specific build prerequisite. There is no platform, OS, or deployment-topology restriction beyond the build flags.

The CVSS 4.0 score of 8.3 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H) correctly captures the tension between unauthenticated network reachability (AV:N, PR:N, UI:N - no authentication barrier once the endpoint is exposed) and the high attack complexity (AC:H) imposed by the dual compile-time flag prerequisite. In practice, the exploitable population is a strict subset of CivetWeb deployments: only those explicitly compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES, the latter flag's name explicitly signalling non-production readiness. Real-world risk is therefore medium for the general CivetWeb ecosystem but high for any affected deployment (e.g., embedded IoT firmware builds that enable compression). EPSS data was not provided, preventing quantitative exploitation-probability assessment. CivetWeb is not listed in CISA KEV, and no confirmed public exploit exists at time of analysis; the RCE tag from VulnCheck is a theoretical impact classification based on the heap corruption primitive, not a confirmed working exploit. DoS via crash is the more certain outcome. No conflicting signals exist between the CVSS vector and the description - both consistently require specific build configuration, making this a real priority only for deployments matching that configuration.

An attacker identifies a network-accessible WebSocket endpoint served by a CivetWeb binary compiled with USE_ZLIB and MG_EXPERIMENTAL_INTERFACES, then sends a WebSocket upgrade request advertising the permessage-deflate extension; if the server accepts (confirming the vulnerable build), the attacker sends a crafted compressed frame with the RSV1 bit set, causing read_websocket() to write a 4-byte zlib sync trailer four bytes past the end of the allocated heap buffer. Depending on the allocator and memory layout at the time of the write, this corrupts adjacent heap metadata and causes an immediate server crash (DoS) or, under controlled conditions, may enable an attacker to manipulate heap structure for potential code execution - though no public exploit demonstrating RCE has been confirmed.