CVE-2026-29035

The experimental feature flag MG_EXPERIMENTAL_INTERFACES enabling this vulnerability is not a meaningful security boundary — it's a label that obscures a dangerous reality. The code path triggering the heap overflow in read_websocket() processes compressed frames with zlib, writing a 4-byte zlib sync trailer past buffer bounds into adjacent heap metadata. This is a known exploitation pattern: corrupting malloc/free metadata to achieve arbitrary write primitives. The 6.5 CVSS score underweights this severity by treating it as a medium-severity denial-of-service when the real attack surface is pre-authentication, network-adjacent WebSocket processing with heap corruption potential. Defenders should audit their CivetWeb build configurations immediately. Check whether MG_EXPERIMENTAL_INTERFACES and USE_ZLIB are both enabled — this combination is common in deployments using Lua scripting or embedded SDKs where build flags are inherited automatically. The EPSS score of 0.00467 assumes this configuration is rare, but that assumption is inverted in practice: experimental flags often have wider deployment than production code because developers enable them for one feature (Lua, compression) and inherit the entire experimental surface without realizing it. WebSocket servers disproportionately sit at network perimeters — API gateways, real-time services, IoT backends — making them high-value targets precisely because they terminate external connections and bridge to internal systems. A successful exploit here isn't just process compromise; it's a foothold into whatever that service connects to. The low CVSS and EPSS also reflect institutional forgetting. Heap overflows in zlib-adjacent network code are a known pattern (lighttpd mod_deflate, nginx chunked handling), yet each instance gets scored in isolation rather than recognized as a family. The practical implication: treat this as a high-priority patch regardless of the medium CVSS, audit downstream forks and Docker images that may carry the vulnerable code forward, and recognize that experimental flags in embedded servers rarely get disabled — they get forgotten. Patch now; the scoring models are measuring past assumptions, not current risk.

Reviewed through automated stages and approved by a human before publication.