Zephyrproject Zephyr vulnerabilities
194 published vulnerabilities in Zephyrproject Zephyr. The most were published in 2026 (80), and 80 so far in 2026.
Zephyrproject Zephyr vulnerabilities by year
2017
2018
2020
2021
2022
2023
2024
2025
2026
Most exploited Zephyrproject Zephyr vulnerabilities
- CVE-2026-5067 Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key
- CVE-2022-3806 Bluetooth HCI Error Handling Double Free
- CVE-2017-14199 Memory corruption in getaddrinfo
- CVE-2018-1000800 Null dereference in n/a
- CVE-2021-3329 DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer
- CVE-2023-0397 DoS: Invalid Initialization in le_read_buffer_size_complete
- CVE-2021-3966 Usb bluetooth device ACL read cb buffer overflow
- CVE-2021-3625 Buffer overflow in Zephyr USB DFU DNLOAD
- CVE-2026-1678 dns: memory‑safety issue in the DNS name parser
- CVE-2024-11263 arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y
- CVE-2020-13601 Possible read out of bounds in dns read
- CVE-2020-10062 Packet length decoding error in MQTT
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.