This vulnerability arises from the HTTP/1 header parser in Zephyr 3.7.0 copying the Sec-WebSocket-Key header into a fixed-size buffer without guaranteed null termination if the input length matches the buffer size. During WebSocket upgrade handling, this buffer is copied to a local stack buffer and passed to strlen(), which can read beyond the buffer bounds if no null terminator is present. Subsequent concatenation with the WebSocket magic string can cause out-of-bounds write on the stack, leading to memory corruption. The flaw can be triggered remotely without authentication, impacting confidentiality, integrity, and availability.

Successful exploitation can result in out-of-bounds read and write on stack memory, causing application crashes (denial of service) and potentially arbitrary code execution. The vulnerability affects confidentiality, integrity, and availability of the affected system. It requires no privileges or user interaction and can be triggered remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, disabling the CONFIG_HTTP_SERVER_WEBSOCKET feature will mitigate exposure to this vulnerability. Monitor the Zephyr project advisories for updates and apply patches promptly once released.