PoC-Exploit-CVE-2024-20467

Cisco IOS XE CVE-2024-20467 漏洞利用 概述 该漏洞利用针对 Cisco IOS XE Software 中 IPv4 分片重组代码中的漏洞。该漏洞允许未认证的远程攻击者在受影响设备上引发拒绝服务 DoS 状态。 受影响设备 路由器：Cisco ASR 1000 系列 型号：Cisco cBR-8 软件版本：Cisco IOS XE Software 版本 17.12.1 和 17.12.1a 漏洞详情 类型：拒绝服务 DoS 原因：分片重组过程中资源管理不当。 攻击向量...

CVE-2026-71971

The U-Boot bootloader (versions before 2026.10-rc3 ) is vulnerable to an out-of-bounds write in the ‘net_defragment‘ function within net/net.c when CONFIG_IP_DEFRAG is enabled. A remote attacker can trigger this by sending a crafted IP fragment with a non-zero offset and the More-Fragments flag s...

CVE-2026-71971 U-Boot before 2026.10-rc3 Out-of-Bounds Write in IP Fragment Reassembly

U-Boot before 2026.10-rc3 with CONFIGIPDEFRAG enabled contains an out-of-bounds write vulnerability in the netdefragment function in net/net.c. Remote attackers can send a crafted IP fragment with non-zero offset and More-Fragments flag set during netboot to corrupt adjacent memory and crash the...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

CVE-2026-42772

A flaw in OpenSSL allows a remote attacker to cause a Denial of Service (DoS) by exploiting an inefficient QUIC stream reassembly algorithm. When packets arrive out of order, the software falls back to a head-to-tail linear search for fragments in a doubly-linked list. By manipulating sequence of...

CVE-2026-42772 Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

Potential CPU DoS via O(n^2) Fragment Reassembly in QUIC

Issue summary: The QUIC stream reassembly algorithm performance deteriorates progressively as packets are arriving out of order. The worst case has a quadratic complexity proportional to the number of stream frames kept in the buffer for the received stream data. Impact summary: A remote QUIC pee...

librenswan: IKEv2 Denial of Service via malformed fragmentation

A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets fragments containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check assertion failure. A remote, unauthenticated...

PT-2026-96273

Name of the Vulnerable Software and Affected Versions Espressif ESP-hosted Wi-Fi driver affected versions not specified Description The driver parses frames received over SPI from the ESP co-processor in the esp hosted event task function. For control frames, the driver uses the 16-bit TLV field...

SUSE CVE-2026-89951

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

CVE-2026-89951

CVE-2026-89951 affects the batman-adv module in the Linux kernel. During fragment reassembly, the skb from the highest-numbered buffered fragment is reused as the merged packet. If that fragment was received on a hard interface that is deleted before reassembly completes, the merged skb re-enters...

CVE-2026-89951: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix stale receive device on merged fragments Fragment reassembly reuses the skb from the highest-numbered buffered fragment as the merged packet. When that fragment was received on a hard interface which is deleted...

PT-2026-93592

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where fragment reassembly reuses the socket buffer skb from the highest-numbered buffered fragment as the merged packet. If that fragment was...

OPENSUSE-SU-2026:21851-1 Security update for kronosnet

This update for kronosnet fixes the following issues: - CVE-2026-15811: improper sanitization of sensitive memory locations following cryptographic configuration adjustments can lead to potential exposure of encryption keys bsc1271923. - CVE-2026-15812: improper verification of packet origins...

Astra Linux – Vulnerability in gnutls28

There is a heap buffer overflow vulnerability in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in the mergehandshakepacket function, where incoming handshake fragments are matched and merged solely based on the handshake type, without verifying that the messagelength...

Astra Linux – Vulnerability in Linux

A vulnerability was discovered in the Linux kernel 5.8.9. The implementations of WEP, WPA, WPA2, and WPA3 reassemble fragments, even though some of them were sent in plain text. This vulnerability can be exploited to inject packets and/or exfiltrate selected fragments when another device sends...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: inet: inetdefrag: prevent sk release while still in use The functions iplocalout and others can pass skb-sk as a function argument. If the skb is a fragment and reassembly occurs before such a function call returns, the sk must n...

CVE-2026-88268

GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service...

CVE-2026-88268 GV-LPC2011/LPC2211 - SSVR Fragment-Reassembly Stack Overflow Denial of Service

GeoVision GV-LPC2211 V1.13 contains an authenticated stack buffer overflow in SSVR fragment reassembly that allows a valid user to crash the SSVR service...