Security

Report a vulnerability

.github/SECURITY.md

Security Policy

Supported versions

The Zephyr project supports the following versions with security updates:

The most recent release, and the release prior to that.
Active LTS releases.

At this time, with the latest release of v4.0, the supported versions are:

v4.0: Current release
v3.7: Current LTS
v3.6: Prior release
v2.7: Prior LTS

Reporting process

Please see our Security Vulnerability Reporting page for details on the process.

arch: riscv: userspace: potential security risk when CONFIG_RISCV_GP=y
GHSA-jjf3-7x72-pqm9 published Nov 15, 2024 by ceolin

Critical
Bluetooth: ots: missing buffer length check
GHSA-qj4r-chj6-h7qp published Oct 4, 2024 by ceolin

Moderate
zephyr: out-of-bound read in utf8_trunc
GHSA-gg46-3rh2-v765 published Oct 4, 2024 by ceolin

Moderate
Bluetooth: ASCS Unchecked tailroom of the response buffer
GHSA-m22j-ccg7-4v4h published Oct 4, 2024 by ceolin

Moderate
BT: HCI: adv_ext_report Improper discarding in adv_ext_report
GHSA-p5j7-v26w-wmcp published Sep 13, 2024 by ceolin

High
BT: Classic: SDP OOB access in get_att_search_list
GHSA-pm38-7g85-cf4f published Sep 13, 2024 by ceolin

High
BT:Classic: Multiple missing buf length checks
GHSA-2mp4-4g6f-cqcx published Sep 13, 2024 by ceolin

High
BT: Unchecked user input in bap_broadcast_assistant
GHSA-r8h3-64gp-wv7f published Sep 13, 2024 by ceolin

Moderate
Missing length checks of net_buf in rfcomm_handle_data
GHSA-7833-fcpm-3ggm published Sep 13, 2024 by ceolin

Moderate
BT: Encryption procedure host vulnerability
GHSA-gvv5-66hw-5qrc published Sep 13, 2024 by ceolin

High

Learn more about advisories related to zephyrproject-rtos/zephyr in the GitHub Advisory Database