Zephyrproject: >> Zephyr >> 1.6.99 Security Vulnerabilities
The function responsible for handling BLE connection responses does not verify whether a response is expected—that is, whether the device has initiated a connection request. Instead, it relies solely on identifier matching.
CVSS Score
4.3
EPSS Score
0.004
Published
2025-09-19
A denial-of-service issue in the dns implemenation could cause an infinite loop.
CVSS Score
7.5
EPSS Score
0.005
Published
2025-06-24
A lack of input validation allows for out of bounds reads caused by malicious or malformed packets.
CVSS Score
8.2
EPSS Score
0.004
Published
2025-02-25
A malicious or malformed DNS packet without a payload can cause an out-of-bounds read, resulting in a crash (denial of service) or an incorrect computation.
CVSS Score
8.2
EPSS Score
0.003
Published
2025-02-25
No proper validation of the length of user input in http_server_get_content_type_from_extension.
CVSS Score
8.6
EPSS Score
0.003
Published
2025-02-03
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
CVSS Score
7.5
EPSS Score
0.004
Published
2024-12-16
When the Global Pointer (GP) relative addressing is enabled (CONFIG_RISCV_GP=y), the gp reg points at 0x800 bytes past the start of the .sdata section which is then used by the linker to relax accesses to global symbols.
CVSS Score
9.3
EPSS Score
0.002
Published
2024-11-15
No proper validation of the length of user input in olcp_ind_handler in zephyr/subsys/bluetooth/services/ots/ots_client.c.
CVSS Score
6.3
EPSS Score
0.003
Published
2024-10-04
In utf8_trunc in zephyr/lib/utils/utf8.c, last_byte_p can point to one byte before the string pointer if the string is empty.
CVSS Score
6.3
EPSS Score
0.006
Published
2024-10-04
In ascs_cp_rsp_add in /subsys/bluetooth/audio/ascs.c, an unchecked tailroom could lead to a global buffer overflow.
CVSS Score
6.3
EPSS Score
0.003
Published
2024-10-04