zephyrproject-rtos vulnerabilities

CVEs per yearBy the year they were published

1. 202017
2. 202123
3. 202213
4. 202325
5. 202420
6. 202514
7. 202615

Newest CVEs

• CVE-2026-13351

  net: Maliciously fragmented IPv6 packets can prevent receiving/processing future incoming packets

  zephyrproject-rtos · Zephyr

  High7.5
• CVE-2026-5068

  bt: l2cap le coc: remote oob write via seg counter stored in net_buf user_data

  zephyrproject-rtos · Zephyr

  High7.6
• CVE-2026-5067

  Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key

  zephyrproject-rtos · Zephyr

  Critical9.8
• CVE-2026-5066

  net: sockets: tls: Potential out-of-bounds write/read in socket_op_vtable::connect function

  zephyrproject-rtos · Zephyr

  Medium6.3
• CVE-2026-5589

  Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem.

  zephyrproject-rtos · Zephyr

  Medium6.3
• CVE-2026-5071

  can: Local Denial of Service via SocketCAN Send

  zephyrproject-rtos · Zephyr

  Medium6.1
• CVE-2026-5072

  ptp: Potential Denial of Service via PTP Interval Shift

  zephyrproject-rtos · Zephyr

  Medium6.5
• CVE-2026-1681

  net: Stack Overflow with Ping (to own IP Address) via Shell

  zephyrproject-rtos · Zephyr

  Medium6.1
• CVE-2026-1677

  net: TLS 1.2 connections allowed on TLS 1.3 sockets

  zephyrproject-rtos · Zephyr

  Medium5.3
• CVE-2026-5590

  net: ip/tcp: Null pointer dereference can be triggered by a race condition

  zephyrproject-rtos · Zephyr

  Medium6.4