CVE-2026-29035 CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression
Unauthenticated attackers can trigger heap or stack buffer overflows in CivetWeb via crafted WebSocket frames, potentially leading to code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-29035?
CVE-2026-29035 is a high-severity memory corruption vulnerability in civetweb, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.
Weakness: CWE-787
Which versions are affected by CVE-2026-29035?
How do I fix CVE-2026-29035?
No fix has been published for CVE-2026-29035 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-29035 being exploited?
There is no known exploitation of CVE-2026-29035 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-29035, GHSA-xvrx-cw3m-h23c.