CVE-2026-111711

Netcore NR256CN through 1.5.140116 are vulnerable to a pre-authentication stack overflow in the Boa web server 's user_ok() function. The root cause is the use of unbounded strcpy() calls to copy Basic-auth usernames into 64-byte stack buffers. An unauthenticated attacker can trigger this by send...