This vulnerability in Zephyr's HTTP server occurs because the HTTP/1 header parser copies the Sec-WebSocket-Key header into a fixed-size buffer using a bounded copy that does not guarantee null termination if the input length matches the buffer size. Later, the buffer is copied to a local stack buffer and passed to strlen(); if no null terminator is present within bounds, strlen() reads beyond the buffer, and subsequent concatenation with the WebSocket magic string causes out-of-bounds write. This leads to stack memory corruption, causing crashes or potentially allowing remote code execution. The issue is reachable only when CONFIG_HTTP_SERVER_WEBSOCKET is enabled.

An unauthenticated remote attacker can exploit this vulnerability to cause out-of-bounds read and write on stack memory, resulting in denial of service (crash) or potentially remote code execution. The vulnerability affects confidentiality, integrity, and availability of the affected system. The CVSS score of 9.8 reflects its critical severity and ease of exploitation over the network without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the HTTP server WebSocket feature (CONFIG_HTTP_SERVER_WEBSOCKET) if feasible to mitigate exposure.