CVE-2026-10657 Zephyrproject CVE debrief

Who should care

Operators and developers using Zephyr's DNS resolver, particularly those with CONFIG_MDNS_RESOLVER enabled, should be aware of this vulnerability and take steps to defend against it. This includes reviewing and updating Zephyr configurations, implementing careful handling of DNS queries and hostname lengths, and applying patches or updates provided by Zephyr.

Technical summary

The vulnerability is caused by a fixed-length memcmp in dns_resolve_name_internal() that reads 7 bytes from the suffix pointer, potentially reading beyond the string's NUL terminator when the hostname's final label is shorter than 7 bytes. This can cause a denial of service when the over-read crosses an allocation boundary and faults. The vulnerability exists since Zephyr version 1.10.0 and is fixed by replacing the fixed-length memcmp with a NUL-safe strcmp. The CVE record was published on 2026-07-05T23:16:52.863Z and last modified on 2026-07-08T14:55:01.560Z.

Defensive priority

Low-severity denial of service vulnerability requires careful handling of DNS queries and hostname lengths, with priority on patching and compensating controls for exposed systems.

Recommended defensive actions

• Review and update Zephyr configurations to ensure CONFIG_MDNS_RESOLVER is not enabled unnecessarily.
• Implement careful handling of DNS queries and hostname lengths to prevent faults.
• Apply patches or updates provided by Zephyr to fix the vulnerability.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists since Zephyr version 1.10.0 and is fixed by replacing the fixed-length memcmp with a NUL-safe strcmp. The CVE record was published on 2026-07-05T23:16:52.863Z and last modified on 2026-07-08T14:55:01.560Z. Evidence is limited to public statements from Zephyr and CVE.org. Defenders should verify patch application and review system configurations for CONFIG_MDNS_RESOLVER.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.