CVE-2026-29035: Civetweb

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.

Affected products

• Civetweb Civetweb: up to and including 4a4f0c95

Published 2026-08-11. Last modified 2026-09-24.