CVE-2026-63626 Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

Mandriva Linux Security Advisory : ppp (MDVSA-2015:135)

Updated ppp packages fix security vulnerability : A vulnerability in ppp before 2.4.7 may enable an unprivileged attacker to access privileged options CVE-2014-3158. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...