Summary
CVE-2026-29035 is an out-of-bounds write (buffer overflow) vulnerability in CivetWeb, an embeddable, open-source C/C++ web server library widely used inside other applications and IoT/embedded devices. The flaw resides in the read_websocket() function and is triggered when a CivetWeb build that enables the USE_ZLIB and MG_EXPERIMENTAL_INTERFACES compile-time options negotiates the WebSocket permessage-deflate extension; a remote, unauthenticated attacker can send a crafted compressed WebSocket frame to write 4 bytes past the end of an allocated buffer, potentially causing heap corruption, denial of service, or code execution. The issue was assigned a CVSS score of 8.3 (High) and is remotely exploitable over the network with no authentication required.
Technical details
- Root cause:
read_websocket()allocates a receive buffer sized to the incoming payload length (data_len) but, when permessage-deflate decompression is active, the code appends a fixed 4-byte zlib sync-flush trailer (00 00 FF FF) to the decompression input without accounting for those extra bytes in the buffer size calculation, resulting in a 4-byte out-of-bounds write. - Trigger conditions: The vulnerable code path is only reachable when the server binary was compiled with both
USE_ZLIBandMG_EXPERIMENTAL_INTERFACESdefined, and the client successfully negotiates thepermessage-deflateWebSocket extension during the handshake. - Attack vector: A remote, unauthenticated attacker completes a WebSocket handshake requesting
permessage-deflate, then sends a crafted WebSocket frame with the RSV1 bit set (indicating a compressed payload) sized so the appended zlib trailer overflows the allocated buffer. - Impact: Out-of-bounds heap write that can corrupt heap metadata or adjacent memory, leading to denial of service (crash) and potentially remote code execution depending on heap layout and allocator behavior.
Affected software
- CivetWeb source tree (GitHub
civetweb/civetweb), master branch, up to and including commit4a4f0c95 - Only builds compiled with both
USE_ZLIBandMG_EXPERIMENTAL_INTERFACESdefined are affected - No official versioned release (the last tagged release is v1.16, predating this code path); affected deployments are those building directly from the master branch or from downstream packages that include the vulnerable commit range
Severity
- CVSS v4.0 Base Score: 8.3 (High)
- Vector:
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N - CWE-787: Out-of-bounds Write
Mitigation and recommended actions
- Immediate: Update to a CivetWeb build that includes commit
d110e87("Fix memory allocation condition for websocket payload"), which reserves the additional 4 bytes needed for the zlib trailer when sizing the WebSocket receive buffer. This fix is available on thecivetweb/civetwebmaster branch as of April 19, 2026. - If patching is not immediately possible:
- Disable the
USE_ZLIBand/orMG_EXPERIMENTAL_INTERFACESbuild options and recompile without permessage-deflate support to eliminate the vulnerable code path entirely. - If WebSocket compression cannot be disabled, restrict or monitor exposure of WebSocket endpoints (e.g., via a reverse proxy or WAF that can strip or block
Sec-WebSocket-Extensions: permessage-deflatenegotiation) until the patched build is deployed. - Since CivetWeb is embedded within other applications, inventory downstream products and firmware that statically link CivetWeb to confirm whether they compile with the affected options and require an update from their respective vendors.
- Disable the

