PoC-Exploit-CVE-2024-20467

Exploit for Cisco IOS XE CVE-2024-20467 Vulnerability Overview This exploit targets a vulnerability in the IPv4 fragment assembly code found in Cisco IOS XE Software. The vulnerability allows an unauthenticated remote attacker to cause a denial of service DoS condition on vulnerable devices...

kernel: inet: frags: strip GSO state from fragments before reassembly

A flaw was found in the Linux kernel's network fragment reassembly process. An unprivileged local user, or a guest in a virtualized environment, could craft specially formed IPv4 or IPv6 network fragments that incorrectly retain Generic Segmentation Offload GSO state after reassembly. This...

kernel: inet: frags: strip GSO state from fragments before reassembly

A flaw was found in the Linux kernel's network fragment reassembly process. An unprivileged local user, or a guest in a virtualized environment, could craft specially formed IPv4 or IPv6 network fragments that incorrectly retain Generic Segmentation Offload GSO state after reassembly. This...

kernel: inet: frags: strip GSO state from fragments before reassembly

A flaw was found in the Linux kernel's network fragment reassembly process. An unprivileged local user, or a guest in a virtualized environment, could craft specially formed IPv4 or IPv6 network fragments that incorrectly retain Generic Segmentation Offload GSO state after reassembly. This...

Linux Kernel Security Vulnerabilities

The Linux kernel version 4.3 contains a security vulnerability. This vulnerability arises from the mac80211 fragment reassembly process, where the extralen field is set to u16. Accruing the length of oversized fragments results in integer overflows, leading to insufficient buffer allocation and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fixed the issue of fragment reassembly length accounting. batman-adv maintains a running payload length for queued fragments and uses this length to validate a fragment chain before reassembly. Currently, this...

UBUNTU-CVE-2026-110833

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and...

CVE-2026-110833

FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy. Attackers can send a FIRST fragment followed by continuation fragments without LAST, growing per-session heap streams proportional to traffic and...

Astra Linux – Vulnerability in Linux

A vulnerability was discovered in the Linux kernel 5.8.9. The implementations of WEP, WPA, WPA2, and WPA3 reassemble fragments, even though some of them were sent in plain text. This vulnerability can be exploited to inject packets and/or exfiltrate selected fragments when another device sends...

Astra Linux – Vulnerability in gnutls28

There is a heap buffer overflow vulnerability in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in the mergehandshakepacket function, where incoming handshake fragments are matched and merged solely based on the handshake type, without verifying that the messagelength...

Cisco ASA Uncontrolled Resource Consumption (CVE-2020-3373)

A vulnerability in the IP fragment-handling implementation of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a memory leak on an affected device. This memory leak could prevent traffic from...

CVE-2026-71971 U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly

U-Boot before 2026.10-rc3 with CONFIGIPDEFRAG enabled contains an out-of-bounds write vulnerability in the netdefragment function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the...

CVE-2026-71971

The U-Boot bootloader (versions before 2026.10-rc3 ) is vulnerable to an out-of-bounds write in the ‘net_defragment‘ function within net/net.c when CONFIG_IP_DEFRAG is enabled. A remote attacker can trigger this by sending a crafted IP fragment with a non-zero offset and the More-Fragments flag s...

CVE-2026-42772

A flaw in OpenSSL allows a remote attacker to cause a Denial of Service (DoS) by exploiting an inefficient QUIC stream reassembly algorithm. When packets arrive out of order, the software falls back to a head-to-tail linear search for fragments in a doubly-linked list. By manipulating sequence of...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

PT-2026-96273

Name of the Vulnerable Software and Affected Versions Espressif ESP-hosted Wi-Fi driver affected versions not specified Description The driver parses frames received over SPI from the ESP co-processor in the esp hosted event task function. For control frames, the driver uses the 16-bit TLV field...