The HTTP client's debug helper printheaderfield() in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s…

The HTTP client's debug helper printheaderfield() in subsys/net/lib/http/httpclient.c formatted an httpparser data-callback slice with a %s conversion: snprintk(output, len + 1, "%s", str). The parser hands its callbacks a pointer and a length into the caller's receive buffer, and those bytes are not NUL terminated. The size argument of snprintk() bounds only the destination, while the %s conversion measures the source first — lib/os/cbprintfcomplete.c uses strlen() when no precision is given, and lib/os/cbprintfnano.c uses strlen() unconditionally — so the read walks past the end of the header field and past the end of the receive buffer until it finds a zero byte. The slice reaches the helper from onurl(), onheaderfield() and onheadervalue(), which the parser invokes on bytes that httpwaitdata() read straight off the socket into the application-supplied recvbuf. A malicious or compromised HTTP server, or an attacker able to answer a plaintext request, therefore controls both the header field and the bytes that follow it in the buffer, and can guarantee that no zero byte appears before the buffer ends, forcing the over-read. The in-tree tests/net/lib/httpclient suite reproduces…

curl https://cve.zerocrew.in/api/cve/CVE-2026-90588