UBUNTU-CVE-2026-90588

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2026-90588
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-90588
Upstream
Published
2026-11-10T00:00:00Z
Modified
2026-11-11T09:41:40Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintf_complete.c uses strlen() when no precision is given, and lib/os/cbprintf_nano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte. The slice reaches the helper from on_url(), on_header_field() and on_header_value(), which the parser invokes on bytes that http_wait_data() read straight off the socket into the application-supplied recv_buf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/http_client suite reproduces the over-read under CONFIG_ASAN=y on an ordinary GET. The impact is bounded. The whole helper body is compiled only when the HTTP client log module is explicitly set to Debug (CONFIG_NET_HTTP_LOG_LEVEL_DBG=y, which the global CONFIG_LOG_DEFAULT_LEVEL does not set), so default builds are unaffected. No out-of-bounds write occurs and none of the over-read bytes are emitted into the log, so there is no information disclosure; the consequence is an out-of-bounds read that can fault and panic the device where the buffer abuts an unmapped or MPU/MMU-protected region. The fix copies exactly the len bytes the parser offered with memcpy() and terminates them, instead of relying on a %s conversion (a %.*s precision would not have sufficed, since cbprintf_nano.c measures the source in full before applying it).

References

Affected packages

Ubuntu:16.04:LTS
zephyr

Package

Name
zephyr
Purl
pkg:deb/ubuntu/zephyr?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.2-1
3.1.2-1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build1"
        },
        {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build1"
        },
        {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build1"
        },
        {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build1"
        },
        {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json"
Ubuntu:18.04:LTS
zephyr

Package

Name
zephyr
Purl
pkg:deb/ubuntu/zephyr?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.2-1build1
3.1.2-1build2

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build2"
        },
        {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build2"
        },
        {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build2"
        },
        {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build2"
        },
        {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build2"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json"
Ubuntu:20.04:LTS
zephyr

Package

Name
zephyr
Purl
pkg:deb/ubuntu/zephyr?arch=source&distro=focal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.2-1build3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json"
Ubuntu:22.04:LTS
zephyr

Package

Name
zephyr
Purl
pkg:deb/ubuntu/zephyr?arch=source&distro=jammy

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.2-1build3

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1build3"
        },
        {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1build3"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json"
Ubuntu:24.04:LTS
zephyr

Package

Name
zephyr
Purl
pkg:deb/ubuntu/zephyr?arch=source&distro=noble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.2-1.1
3.1.2-1.1build1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-1.1build1"
        },
        {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-1.1build1"
        },
        {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-1.1build1"
        },
        {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-1.1build1"
        },
        {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-1.1build1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json"
Ubuntu:26.04:LTS
zephyr

Package

Name
zephyr
Purl
pkg:deb/ubuntu/zephyr?arch=source&distro=resolute

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.2-1.1build1
3.1.2-4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json"
Ubuntu:26.10
zephyr

Package

Name
zephyr
Purl
pkg:deb/ubuntu/zephyr?arch=source&distro=stonking

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.1.2-4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "libzephyr4",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "libzephyr4-krb5",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "zephyr-clients",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "zephyr-server",
            "binary_version": "3.1.2-4"
        },
        {
            "binary_name": "zephyr-server-krb5",
            "binary_version": "3.1.2-4"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-90588.json"