CVE-2026-18416 zephyrproject CVE debrief

Who should care

Defenders responsible for Zephyr-based CoAP server subsystems should assess exposure and prioritize patching. This includes operators of IoT devices, industrial control systems, and other platforms that utilize Zephyr's CoAP server subsystem. Vulnerability management teams should verify affected versions and apply patches to prevent exploitation. Security teams should review and update CoAP server configurations to ensure secure communication.

Why it matters

CVE-2026-18416 is a vulnerability in Zephyr's CoAP server subsystem that can be triggered by unauthenticated GET requests. Defenders should prioritize verifying affected versions and applying patches to prevent exploitation.

• Verification of affected versions and patch application is required to prevent exploitation
• Unauthenticated GET requests to /.well-known/core can trigger the vulnerability
• The over-read can lead to undefined behavior, but does not result in information disclosure or a matching error

Technical summary

The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. The URI is not NUL terminated, leading to an over-read when the registered path segment is longer than the supplied URI and the URI is a prefix of it. The over-read occurs because the inner character loop advances its index without testing it against the option length. This results in undefined behavior, but does not lead to information disclosure or a matching error. The fix adds a k >= len guard at the top of the inner loop, ensuring that every uri[k] dereference is within the option value.

Defensive priority

Defenders should prioritize verifying affected versions and applying patches, as the vulnerability can be triggered by unauthenticated GET requests.

Recommended defensive actions

• Verify affected versions of Zephyr and apply patches
• Review and update CoAP server configurations
• Monitor for unauthenticated GET requests to /.well-known/core
• Perform code reviews of custom CoAP server implementations
• Implement compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Review vendor advisories for additional guidance

Evidence notes

The vulnerability was reported in the Zephyr project's CoAP server subsystem. The over-read does not reach the receive buffer and is limited by the length of the resource path segment. This issue was identified through code review and analysis of the CoAP link-format helper match_path_uri() function. The fix adds a k >= len guard at the top of the inner loop, ensuring that every uri[k] dereference is within the option value. Defenders should verify affected versions and apply patches to prevent exploitation. The over-read can lead to

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.