The UpdateHub firmware-update agent's probe handler (z_impl_updatehub_probe() in subsys/mgmt/updatehub/updatehub.c) parses the JSON metadata returned by the update server into a fixed two-level nested-array struct. After parsing it validates only the outer array length (objects_len != 2) and then dereferences objects[1].objects[0].objects.sha256sum via strlen() without checking that the inner object array of element [1] is non-empty.

The metadata is attacker-influenceable network input: the agent fetches it over CoAP from the configured UpdateHub server during its routine OTA probe. A malicious or compromised update server (or, when DTLS is disabled, a network man-in-the-middle) can return a response whose second outer object array is empty. Because the parse target is zero-initialised, the corresponding objects[1].objects[0].objects.sha256sum pointer is NULL, and the subsequent strlen() dereferences address zero. The same defect exists in both the 'any boards' and 'some boards' metadata layouts.

The resulting CPU fault is fatal under Zephyr's default error handling, halting or resetting the device, so the flaw is a remotely triggerable denial of service. Impact is limited to availability; it is a read from NULL with no out-of-bounds write, memory corruption, or information disclosure. The fix rejects metadata whose inner object array is empty before any dereference, on both layouts.

Affected components

• subsys/mgmt/updatehub

Affected versions

All releases shipping the UpdateHub agent up to and including v4.4.0 (vulnerable code present in v4.3.0 and v4.4.0)

Fix

Fixed (merged) in 3424082

Projected fixed version: 4.5.0 (the fix is merged on main but not yet released; this forecast should be confirmed against the actual release).

Introduced by: Pre-v4.3.0: unchecked strlen over objects[1].objects[0].objects.sha256sum present since the JSON-array handling (commit 5fb62ca) and the outer objects_len!=2 check (2020-08-31, 9974a2a)

Evidence

• subsys/mgmt/updatehub/updatehub.c:880-893 — pre-fix flow: validates only outer objects_len!=2, then strlen() on objects[1].objects[0].objects.sha256sum (NULL when inner array empty)
• subsys/mgmt/updatehub/updatehub.c:886-890,926-930 — the added inner-length guard that closes the path on both layouts
• subsys/mgmt/updatehub/updatehub.c:770-771 — metadata_*_boards locals are zero-initialised, so an empty inner array yields a NULL sha256sum pointer
• subsys/mgmt/updatehub/updatehub_priv.h:90-114 — struct layout: objects[2] outer, objects[4]+objects_len inner; sha256sum is const char*
• subsys/mgmt/updatehub/updatehub.c:836-862 — server CoAP response payload (probe_cb) is the parsed metadata, i.e. attacker-controlled network input
• subsys/mgmt/updatehub/updatehub.c:195-206 — DTLS optional (CONFIG_UPDATEHUB_DTLS); default transport plain CoAP to CONFIG_UPDATEHUB_SERVER

Patches

For more information

If you have any questions or comments about this advisory:

• Open an issue in zephyr
• Email us at Zephyr-vulnerabilities

embargo: 2026-08-08