challack

Proof-of-concept code for CVE-2016-5696 This code currently allows reseting connections or injecting into sessions. The attack is implemented against both clients and servers. For detailed information, consult the original publication: Off-Path TCP Exploits: Global Rate Limit Considered Dangerous...

mountain_goat

Hi, I'm a mountain goat and I'm going to ram your TCP connections, because that's a pretty goat thing to do. This is a PoC demonstrating techniques exploiting CVE-2016-5696 Off-Path TCP Exploits: Global Rate Limit Considered Dangerous by Yue Cao, Zhiyun Qian, Zhongjie Wang, Tuan Dao, Srikanth V...

Linux Distros Unpatched Vulnerability : CVE-2026-79977

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the...

Linux Distros Unpatched Vulnerability : CVE-2026-79981

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked -...

UBUNTU-CVE-2026-79977

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

CVE-2026-79981

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...

CVE-2026-79977

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

CVE-2026-79981 DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...

CVE-2026-79981 DNS resolver reuses a single UDP source port for all queries, easing off-path answer spoofing

The DNS stub resolver in subsys/net/lib/dns/resolve.c binds one UDP socket per configured server when the resolver context is initialised dnsresolveinitlocked - registerdispatcher - dnsdispatcherregister, with the local port left at 0 so the stack picks an ephemeral port exactly once. dnswrite th...

CVE-2026-79981

The Zephyr RTOS DNS stub resolver (specifically in subsys/net/lib/dns/resolve.c) contains a vulnerability where it binds a single UDP socket per configured server during initialization. Because the source port remains constant for the lifetime of the resolver context while only the 16-bit transac...

CVE-2026-79977 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

CVE-2026-79977 WireGuard peer endpoint learned from unauthenticated transport-data messages allows off-path tunnel hijack in Zephyr

The WireGuard VPN service in subsys/net/lib/wireguard/wg.c updated the peer endpoint from a message it could not authenticate. In handletransportdata, when the 32-bit receiver index of an incoming transport-data message matched no session, the code both scheduled a new handshake and copied the...

Astra Linux – vulnerability in NTP

NTPD in NTP prior to versions 4.2.8p14 and 4.3.x prior to version 4.3.100 allows an off-path attacker to block unauthenticated synchronization by sending a server-mode packet with a spoofed source IP address; this happens because transmissions are rescheduled even when the packet lacks a valid...

Astra Linux – vulnerability in ldns

NLnet Labs’ ldns version 1.2.0 up to and including version 1.9.0, when used in applications as a stub resolver over UDP, fails to match the query destination address and port with the response source address and port. Additionally, neither the query ID nor the nature of the query matches that of...

Astra Linux – vulnerability in linux, linux-5.10

An issue was discovered in the Linux kernel up to version 5.16.11. The mixed IPID assignment method combined with a hash-based IPID assignment policy enables an off-path attacker to inject data into a victim’s TCP session or terminate that session...

PT-2026-110222

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An issue exists in the RFC 6528 initial-sequence-number ISN implementation within subsys/net/ip/tcp.c. The system derives the TCP ISN using a 128-bit secret uniq...

Rocky Linux 9.6 [TuxCare] Security Update: ldns / ldns-devel / ldns-doc / ldns-utils / perl-ldns / etc (ALMALINUX9.6:CLSA-2026:1784215324)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784215324 advisory. - NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as stub resolver over UDP, lacks matching the query...

AlmaLinux 9.6 [TuxCare] Security Update: ldns / ldns-devel / ldns-doc / ldns-utils / perl-ldns / etc (ALMALINUX9.6:CLSA-2026:1784215324)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1784215324 advisory. - NLnet Labs ldns 1.2.0 up to and including versions 1.9.0, when used in applications as stub resolver over UDP, lacks matching the query...

Rocky Linux 9 [CIQ] Security Update: ldns / ldns-debuginfo / ldns-debugsource / ldns-devel / ldns-doc / etc (crlsa-2026_50108)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202650108 advisory. ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching CVE-2026-10846 Tenable has extracted the preceding description block directly fr...

Rocky Linux 10.2 [CIQ] Security Update: ldns / ldns-debuginfo / ldns-debugsource / ldns-devel / ldns-doc / etc (crlsa-2026_49836)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649836 advisory. ldns: ldns: Off-path poisoning attacks due to insufficient query-response matching CVE-2026-10846 Tenable has extracted the preceding description block directly...