CVE-2026-87045 | Zephyr Project up to 4.3.1/4.4.x HTTP/2 Server http_server_http2.c handle_http_frame_header null pointer dereference

November 6, 2026 Yanac

A vulnerability categorized as critical has been discovered in Zephyr Project Zephyr up to 4.3.1/4.4.x. Affected is the function handle_http_frame_header of the file subsys/net/lib/http/http_server_http2.c of the component HTTP2 Server. Such manipulation leads to null pointer dereference.

This vulnerability is documented as CVE-2026-87045. The attack can be executed remotely. There is not any exploit available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More