Description (CNA)
CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| civetweb / civetweb | affected 0 through 4a4f0c95 |
CWE
CWE-787
References
- https://github.com/civetweb/civetweb
- https://www.vulncheck.com/advisories/civetweb-heap-stack-buffer-overflow-via-websocket-permessage-deflate-decompression
ADP enrichment
No English description supplied.
No references supplied.