CVE-2026-97152: 
Linux Debian 脆弱性の分析と軽減

CVE-2026-97152 is a remotely exploitable heap-based buffer overflow in the WebSocket transport layer of Nanomsg, caused by an unchecked copy of the Sec-WebSocket-Version HTTP header via snprintf. It affects Nanomsg versions 0.5-beta (0.5.0) through all 1.x releases prior to 1.2.3. The vulnerability was disclosed on September 24, 2026, with a patch merged on August 2, 2026, and released in version 1.2.3. It carries a CVSS v4.0 base score of 8.6 (High) (Github Advisory, Feedly).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-120 (Buffer Copy without Checking Size of Input). In src/transports/ws/ws_handshake.c, the WebSocket handshake handler copies the client-supplied Sec-WebSocket-Version header value into a fixed-size response buffer using snprintf without validating the length of the input, allowing an attacker to overflow the heap buffer. The fix, introduced in PR #1130, bounds the snprintf call using sizeof(self->response) and hardcodes the failure response version to 13 rather than reflecting the client-provided value (GitHub PR #1130, Github Advisory). Exploitation requires low privileges (e.g., the ability to initiate a WebSocket connection to the target), but no user interaction or special deployment conditions (Github Advisory).

Successful exploitation can result in arbitrary code execution on the host running the vulnerable Nanomsg WebSocket endpoint, with high integrity and availability impact on the vulnerable system. The CVSS v4.0 scoring also reflects high confidentiality, integrity, and availability impact on subsequent systems, indicating potential for lateral movement or broader infrastructure compromise. While direct confidentiality impact on the vulnerable system itself is rated None (data is not directly leaked by the overflow), an attacker achieving code execution could access sensitive data, disrupt services, or pivot to connected systems (Github Advisory, Feedly).

As of the disclosure date (September 24, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported. The attack vector is network-accessible with low complexity and low privilege requirements, making the vulnerability relatively straightforward to exploit if a PoC were developed (Github Advisory).

1. Reconnaissance: Identify services exposing Nanomsg WebSocket transport endpoints (default port varies by application configuration) using network scanners such as Nmap or Shodan, targeting systems running Nanomsg versions 0.5.0 through 1.2.2.
2. Establish WebSocket connection: Initiate a WebSocket upgrade request (HTTP GET with Upgrade: websocket header) to the target Nanomsg endpoint. Low-privilege access (e.g., any authenticated or network-reachable user) is sufficient.
3. Craft malicious header: Include an oversized or specially crafted Sec-WebSocket-Version header value in the HTTP upgrade request — a string significantly longer than the fixed response buffer in ws_handshake.c.
4. Trigger buffer overflow: The server-side snprintf call copies the attacker-controlled header value into the fixed-size heap buffer without bounds checking, overflowing adjacent heap memory.
5. Achieve code execution: By carefully controlling the overflow content (e.g., overwriting heap metadata or function pointers), an attacker can redirect execution flow to attacker-controlled shellcode or a ROP chain, achieving arbitrary code execution as the Nanomsg process user (GitHub PR #1130, Github Advisory).

• Network: Inbound WebSocket upgrade requests (HTTP GET with Upgrade: websocket) containing abnormally long or malformed Sec-WebSocket-Version header values (e.g., values exceeding typical version strings like "13"); unexpected outbound connections from the Nanomsg process to external IPs following such requests.
• Logs: Application or system logs showing crashes, segmentation faults, or abnormal termination of the Nanomsg process; repeated failed WebSocket handshake attempts from the same source IP.
• Process: Unexpected child processes spawned by the Nanomsg service process (e.g., shells, network utilities); unusual memory usage or heap corruption errors in process logs.
• File System: New or modified files in directories writable by the Nanomsg service account, such as dropped scripts, backdoors, or cron entries.

Upgrade Nanomsg to version 1.2.3 or later, which includes the fix for the unchecked snprintf call in the WebSocket handshake handler (Nanomsg Release 1.2.3). If immediate patching is not feasible, restrict network access to Nanomsg WebSocket endpoints to trusted IP ranges using firewall rules, or disable WebSocket transport if it is not operationally required (Feedly). Red Hat has tracked this issue under Bugzilla bug 2539915 with urgent priority (Red Hat Bugzilla).

Red Hat triaged the vulnerability as urgent severity and opened a tracking bug (BZ#2539915) shortly after disclosure (Red Hat Bugzilla). The fix was authored by the Nanomsg project maintainer (gdamore) and merged via PR #1130 on August 2, 2026, prior to the CVE's public disclosure in September 2026 (GitHub PR #1130). No significant broader media coverage or notable researcher commentary has been identified at this time.