CVE-2020-8597

CVE-2020-8597 eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions. If you manage to get "EAP: unauthenticated peer name" long enough, seems like my client limits it to 255, you can do Buffer Overflow. You still have to beat the Sta...

linux-kernel-codex-harness-v2

Kernel Codex Harness v2 한국어 | English Research Tool · Original Import: 3 April 2026 · v2 Documentation Revision: 11 July 2026 External Signal: From Attention Allocation to Provenance-Aware Triage Use reproducible observations to guide model attention, then use repository provenance to organize...

CVE-2026-111220

pfSense CE versions through 2.9.0 are vulnerable to a crontab injection vulnerability in the interfaces_ppps_edit.php component. The root cause is the failure to escape newline characters in the ptpid or reset hour/minute fields, which are processed by the configure_cron() function. An authentica...

CVE-2026-63626

A flaw was found in Mongoose. An unauthenticated adjacent attacker can exploit this issue by sending a specially crafted Point-to-Point Protocol PPP packet containing an oversized length field during IPv6 Control Protocol IPv6CP negotiation. This lack of bounds validation causes out-of-bounds...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ppp: Fixed race conditions in pppfillforwardpath. pppfillforwardpath has two race conditions: 1. The ppp-channels list can change between listempty and listfirstentry, as ppplock is not held. If the only channel is deleted in...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: ppp: Rejects packets that are claimed to be LCP packets but are actually malformed packets. Since pppasyncencode assumes that the packets are valid LCP packets with codes from 1 to 7 inclusive, add pppcheckpacket to ensure that t...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ppp: Fixed the “KMSAN: uninit-value” warning with bpf. Syzbot detected a “KMSAN: uninit-value” warning 1. This issue arises because the ppp driver does not initialize a 2-byte header when using socket filter. The following code c...

Astra Linux – Vulnerability in Linux

A flaw was discovered in the HDLCPPP module of the Linux kernel in versions prior to 5.9-rc7. Memory corruption and a read overflow occur due to improper input validation in the pppcpparsecr function, which can cause the system to crash or lead to a denial of service. The greatest threat posed by...

CVE-2026-63626

The Mongoose embedded web server and network library is vulnerable to an out-of-bounds read and heap overflow due to a missing bounds check in ppp_handle_ipv6cp(). When MG_ENABLE_TCPIP and MG_ENABLE_IPV6 are enabled, an unauthenticated adjacent peer can send a Configure-Request with an oversized ...

CVE-2026-63626

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

CVE-2026-63626 Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

EUVD-2026-101599

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

CVE-2026-63626 Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

CVE-2026-63626: Heap-based Buffer Overflow

Mongoose is an embedded web server and network library. Prior to 7.23, ppphandleipv6cp in src/l2ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MGENABLETCPIP and MGENABLEIPV6, an unauthenticated adjacent peer can complet...

CVE-2026-84015

A heap-based buffer overflow exists in the Remote Access Point-to-Point Protocol (PPP) EAP-TLS component within Microsoft Windows . This vulnerability allows an unauthorized attacker to execute arbitrary code over a network. The impact is rated as CRITICAL with a CVSS score of 9.80 . No specific ...

Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Access Point-to-Point Protocol PPP EAP-TLS allows an unauthorized attacker to execute code over a network...

CVE-2026-84015: Heap-based Buffer Overflow

Heap-based buffer overflow in Remote Access Point-to-Point Protocol PPP EAP-TLS allows an unauthorized attacker to execute code over a network...

Microsoft Windows: CVE-2026-84015: Remote Access Point-to-Point Protocol (PPP) EAP-TLS Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Access Point-to-Point Protocol PPP EAP-TLS allows an unauthorized attacker to execute code over a network...

PT-2026-112704

Name of the Vulnerable Software and Affected Versions Microsoft Windows affected versions not specified Description A heap-based buffer overflow exists in the Remote Access Point-to-Point Protocol PPP EAP-TLS. This flaw allows an unauthorized attacker to execute arbitrary code over a network. A...

CVE-2026-98287

A flaw was found in the Linux kernel's Point-to-Point Protocol over ATM PPPoATM subsystem. This vulnerability allows a local attacker to cause a Denial of Service DoS or memory corruption by transmitting network packets across bridged Point-to-Point Protocol PPP channels. The issue occurs because...