---
id: CVE-2026-29035
title: >-
  CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow
  vulnerability in the read_websocket() function that allows unauthenticated
  remote attackers to corrupt memory by sending compressed WebSocket frames when
  both USE_ZLIB …
summary: >-
  CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow
  vulnerability in the read_websocket() function that allows unauthenticated
  remote attackers to corrupt memory by sending compressed WebSocket frames when
  both USE_ZLIB …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-787
published: '2026-08-11'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:32:04.063'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-29035'
references:
  - url: 'https://github.com/civetweb/civetweb'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/civetweb-heap-stack-buffer-overflow-via-websocket-permessage-deflate-decompression
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00612
epssPercentile: 0.46997
ingestedAt: '2026-09-24T20:51:40.196Z'
---

## Overview

CivetWeb (commit 4a4f0c95) contains a heap and stack buffer overflow vulnerability in the read_websocket() function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE_ZLIB and MG_EXPERIMENTAL_INTERFACES are defined. Attackers can negotiate permessage-deflate during the WebSocket handshake and send a crafted frame with the RSV1 bit set, causing the server to write a 4-byte zlib sync trailer out-of-bounds past the allocated buffer, leading to heap metadata corruption, denial of service, or potential code execution.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.