14363 matches found
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
CVE-2026-99088 net: openvswitch: validate transport header presence in set_ipv6_addr
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in setipv6addr When executing IPv6 address rewrite actions on IPv6 fragments, setipv6addr calls updateipv6checksum. If parseipv6hdr processes a non-first IPv6 fragment, it sets...
CVE-2026-99088 net: openvswitch: validate transport header presence in set_ipv6_addr
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in setipv6addr When executing IPv6 address rewrite actions on IPv6 fragments, setipv6addr calls updateipv6checksum. If parseipv6hdr processes a non-first IPv6 fragment, it sets...
CVE-2026-99088
A vulnerability exists in the Linux kernel 's OpenvSwitch component specifically within the set_ipv6_addr() function. When processing IPv6 fragments , parse_ipv6hdr() sets the protocol to NEXTHDR_FRAGMENT without calling skb_set_transport_header(). Consequently, update_ipv6_checksum() uncondition...
EUVD-2026-109894
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: validate transport header presence in setipv6addr When executing IPv6 address rewrite actions on IPv6 fragments, setipv6addr calls updateipv6checksum. If parseipv6hdr processes a non-first IPv6 fragment, it sets...
CVE-2026-99070
A flaw was found in the Linux kernel's IPv6 subsystem. When nexthop compatibility mode is enabled, a race condition between sizing and populating route notification buffers can trigger an unexpected kernel warning. A local user could trigger this condition during concurrent route modifications,...
CVE-2026-115700
Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...
CVE-2022-25064
CVE-2022-25064 This script exploits a OS Command Injection vulnerability in the TPLink WR840N router, using the configure function IPv6 protocol...
CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...
CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...
EEF-CVE-2026-115700 SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Summary Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not ...
EUVD-2026-109834
Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...
CVE-2026-115700
Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...
CVE-2026-115700
The benoitc hackney library (versions 4.0.1 to 4.8.x ) is vulnerable to Server-Side Request Forgery (SSRF) due to an Interpretation Conflict in hackney_url. Specifically, the hackney_url:normalize/2 function fails to block percent-encoded bracketed IPv6 literals (e.g., %5B%3A%3Affff%3A127%2E0%2E0...
freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler
A stack-based buffer overflow exists in FreeIPMI's ipmi-oem tool, in the Dell OEM handler for the get-system-info cmc-ipv6-info subcommand. The vulnerable function outputdellsysteminfocmcipv6info uses a 256-byte stack buffer but allows up to 65536 bytes of data to be copied from a BMC response...
freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler
A stack-based buffer overflow exists in FreeIPMI's ipmi-oem tool, in the Dell OEM handler for the get-system-info cmc-ipv6-info subcommand. The vulnerable function outputdellsysteminfocmcipv6info uses a 256-byte stack buffer but allows up to 65536 bytes of data to be copied from a BMC response...
ip-https-tools
ip-https-tools A collection of tools for the IP over HTTPS IP-HTTPS Tunneling Protocol used by Microsoft DirectAccess to send Teredo related IPv6 packets over an IPv4-based HTTPS session. MS-IPHTTPS protocol pecification DirectAccess Technical Overview DirectAccess Requirements DirectAccess...
PT-2026-123319
Interpretation Conflict vulnerability in hackney url in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...
UBUNTU-CVE-2026-98934
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...
UBUNTU-CVE-2026-99076
In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...