{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-13217 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-13217 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-13217 is a medium-severity vulnerability in zephyrproject zephyr, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-13217 and fix it if it is affected.\n\nWhat it is: CVE-2026-13217 is a medium-severity vulnerability in zephyrproject zephyr, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-13217 in the wild and no public exploit code.\n\nAffected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-13217/ (Markdown: https://insights.sbomify.com/CVE-2026-13217/index.md)","id":"CVE-2026-13217","markdown":"https://insights.sbomify.com/CVE-2026-13217/index.md","name":"CVE-2026-13217","record":{"aliases":["GHSA-w234-pcxp-4q8r"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Zephyr RTOS","requires_auth":"none","summary":"A remote attacker can cause a denial of service on Zephyr-based charge points by sending a malformed OCPP message that triggers a NULL pointer dereference.","user_interaction":"not_required","vuln_class":"null_dereference"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[],"cvss":{"score":5.9,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-476","name":"NULL Pointer Dereference"}],"description":"The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocpp_process_server_msg() the code calls atoi(strtok_r(uid, \"-\", \u0026tmp)) without checking the strtok_r return value. When the server-supplied uid is empty or contains no - delimiter, strtok_r() returns NULL and atoi(NULL) dereferences a NULL pointer, which is undefined behaviour.\n\nThe uid originates from network data: parse_rpc_msg() in subsys/net/lib/ocpp/ocpp_j.c JSON-parses a frame received from the OCPP central system over TCP/WebSocket and copies the server-controlled string into the local buffer. A malicious or compromised central system, or a man-in-the-middle on a non-TLS ws:// connection, can return a malformed uid to reach the defect. No authentication beyond the existing server connection (or MITM position) is required, and the reconstructed pointer is membership-validated by ocpp_session_is_valid(), so the impact is limited to the NULL dereference rather than arbitrary pointer use.\n\nOn Zephyr targets that trap access to address 0 (MMU/MPU platforms or CONFIG_NULL_POINTER_EXCEPTION_DETECTION), the dereference faults inside the OCPP reader thread and invokes the fatal handler, producing a remote denial of service of the charge point; on bare targets where address 0 is readable the call returns 0 and is benign, so the impact is availability-only and platform-conditional.\n\nThe applied fix guards only the first atoi(); the second strtok_r(NULL, \"-\", \u0026tmp) followed by pdu = atoi(buf) in the same function remains unguarded and the identical NULL dereference is still reachable from the same network input when the uid has a first token but no second --delimited token. A complete fix should validate the second token as well.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi","id":"CVE-2026-13217","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"null_dereference","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"Kubevirt: kubevirt: symlink following in writetocachedfile allows host file overwrite from virt-launcher","id":"CVE-2026-13218"},"packages":[],"prev":{"headline":"Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability length","id":"CVE-2026-13216"},"products":["zephyr"],"published":"2026-08-25","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-08-25","vendors":["zephyrproject"]},"summary":"A remote attacker can cause a denial of service on Zephyr-based charge points by sending a malformed OCPP message that triggers a NULL pointer dereference.","url":"https://insights.sbomify.com/CVE-2026-13217/"}