CivetWeb contains a heap and stack buffer overflow vulnerability in the read_websocket() function that can be triggered by unauthenticated remote attackers. This occurs when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined, allowing crafted compressed WebSocket frames with the RSV1 bit set to cause out-of-bounds writes. The vulnerability can lead to heap metadata corruption, denial of service, or potential code execution.