EUVD-2026-56944
GHSA-xvrx-cw3m-h23c
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector (WebSocket over network), high complexity (non-default dual build flags required), no auth needed; availability high (crash), integrity low (heap metadata corruption), no confidentiality impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.
AnalysisAI
Heap and stack buffer overflow in CivetWeb's read_websocket() function (through commit 4a4f0c95) allows unauthenticated remote attackers to corrupt memory by sending crafted compressed WebSocket frames, but only against instances compiled with both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES build flags. Attackers negotiate permessage-deflate during the WebSocket handshake and send an RSV1-flagged frame that triggers a 4-byte zlib sync trailer write past the allocated buffer boundary, corrupting heap metadata and enabling denial of service or potential code execution (per VulnCheck tagging). No public exploit code is confirmed and this CVE does not appear in CISA KEV at time of analysis, but the deterministic 4-byte overwrite primitive is a credible research target; the non-default build configuration substantially limits the real-world exploitable population.
Technical ContextAI
CivetWeb is a lightweight, embeddable C web server and WebSocket library (CPE: cpe:2.3:a:civetweb:civetweb:*:*:*:*:*:*:*:*) widely used in embedded systems, IoT firmware, and desktop applications as a self-contained HTTP/WebSocket backend. The root cause is CWE-787 (Out-of-Bounds Write) in the read_websocket() decompression path: when the permessage-deflate WebSocket extension is negotiated, zlib decompression requires appending a 4-byte sync flush trailer (0x00 0x00 0xFF 0xFF) to the compressed payload before inflating it, but the allocated receive buffer does not reserve space for this suffix. The write lands in adjacent heap or stack memory, corrupting allocator metadata. This code path is conditionally compiled and is only reachable when both USE_ZLIB (enabling zlib compression support) and MG_EXPERIMENTAL_INTERFACES (enabling experimental WebSocket extension negotiation, including permessage-deflate) are defined at build time. All CivetWeb commits up to and including 4a4f0c95 are affected; no patched release tag has been identified from available data.
RemediationAI
No vendor-released patched version is confirmed from the available data; the fix status should be monitored at the upstream repository https://github.com/civetweb/civetweb and via VulnCheck's advisory at https://www.vulncheck.com/advisories/civetweb-heap-stack-buffer-overflow-via-websocket-permessage-deflate-decompression. The most effective immediate compensating control is to rebuild CivetWeb without the MG_EXPERIMENTAL_INTERFACES compile-time flag, which disables the experimental WebSocket compression negotiation path entirely and removes exploitability without requiring any network-level changes; the trade-off is loss of permessage-deflate support, which reduces bandwidth efficiency for WebSocket traffic. Alternatively, removing USE_ZLIB at build time achieves the same result by eliminating the zlib code path. If neither recompilation is feasible, restrict network access to the WebSocket endpoint via firewall ACLs or reverse proxy access controls to limit exposure to trusted clients only, accepting that this does not eliminate the underlying flaw. Do not deploy CivetWeb builds with both flags enabled in production-facing or internet-exposed environments until a patch is released.
Buffer Overflow in the URI parser of CivetWeb 1.14 through 1.16 (latest) allows a remote attacker to achieve remote code
Local privilege escalation in CivetWeb v1.16 service allows authenticated users to execute arbitrary code with SYSTEM pr
A flaw was found in the way civetweb frontend was handling requests for ceph RGW server with SSL enabled. Rated high sev
Out-of-bounds Read in the send_ssi_file function in civetweb.c in CivetWeb through 1.10 allows attackers to cause a Deni
Same weakness CWE-787 – Out-of-bounds Write
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today