PatchTheCVECVE-2026-18416: The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered r
CVE-2026-18416 is a low-severity flaw (CVSS 3.7) affecting zephyr. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing it against the option length len. When a registered path segment is longer than the supplied URI and the URI is a prefix of it, the loop reads uri[
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.7 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 87%) |
| CISA exploited list | No |
| Weakness | CWE-125 |
| Published | 2026-09-28 |
| Last modified | 2026-10-27 |
Last updated 2026-10-27 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-18416?
zephyr: upgrade to 4.4.2. Exact commands for each OS are on this page.
Is CVE-2026-18416 being exploited?
CVE-2026-18416 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-18416 affect?
CVE-2026-18416 affects zephyr. Severity is low (CVSS 3.7). The CoAP link-format helper match_path_uri() in subsys/net/lib/coap/coap_link_format.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop adv
How urgent is CVE-2026-18416?
Priority 21/100. Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-16513 HIGH 7.8 UPGRADE The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_
- CVE-2026-18413 HIGH 7.8 UPGRADE The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buff
- CVE-2026-18414 HIGH 7.8 UPGRADE The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buff
- CVE-2026-18415 MEDIUM 6.3 UPGRADE ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-
- CVE-2026-1677 MEDIUM 5.3 UPGRADE Zephyr sockets created with `IPPROTO_TLS_1_3` can still negotiate a TLS 1.2 connection when both TLS versions