CVE-2026-29035

Received Received - Intake

Heap Buffer Overflow in CivetWeb WebSocket Handling

Publication date: 2026-08-11

Last updated on: 2026-08-12

Assigner: VulnCheck

Description

CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-12

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-30

NVD

CVE-2026-29035

EUVD

EUVD-2026-56944

Affected Vendors & Products

Vendor	Product	Version / Range
civetweb	civetweb	to 4a4f0c95 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

CivetWeb has a heap and stack buffer overflow in the read_websocket() function. When specific compile-time options (USE_ZLIB and MG_EXPERIMENTAL_INTERFACES) are enabled, unauthenticated remote attackers can send compressed WebSocket frames with the RSV1 bit set. This causes the server to write a 4-byte zlib sync trailer out-of-bounds, corrupting memory and potentially leading to denial of service or code execution.

Detection Guidance

Detecting this vulnerability requires monitoring for malformed WebSocket frames with the RSV1 bit set during compressed handshakes. Inspect network traffic for WebSocket connections using tools like Wireshark or tcpdump to filter for frames with the RSV1 bit enabled. Check server logs for crashes or memory corruption errors during WebSocket operations.

Impact Analysis

This vulnerability allows remote attackers to crash the server (denial of service) or execute arbitrary code on the affected system. It requires no authentication and can be triggered by sending specially crafted WebSocket frames, potentially compromising the availability and integrity of the service.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized memory corruption, denial of service, or code execution on affected systems. Such attacks may lead to unauthorized access to sensitive data, violating confidentiality requirements under these regulations.

Mitigation Strategies

Disable WebSocket compression by ensuring USE_ZLIB is not defined during compilation. Update CivetWeb to a patched version if available. Block or monitor WebSocket traffic with unusual compression flags. Restrict access to WebSocket endpoints via firewall rules until patches are applied.

Hi! I’m here to help you understand CVE-2026-29035. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70