CVE-2026-13351

Katalog CVE

CVSS 7.5 · High EPSS 0,49%

Kerentanan Missing Release of Resource after Effective Lifetime pada zephyrproject zephyr. Skor CVSS 3.1 7.5 (High) menurut zephyrproject.org.

Deskripsi (NVD)

Zephyr's IPv6 network stack can be prevented from receiving or processing future incoming packets by sending a small number of maliciously fragmented IPv6 packets. When such a packet is handled by the fragment-header processing path, the associated RX network packet buffer (allocated from a memory slab) is not released back to the pool. Repeating the malicious packet exhausts all RX buffer slots, after which the device can no longer obtain RX buffers and stops receiving traffic, resulting in a denial of service.

Rincian

Terbit di NVD

25 Juni 2026

Terakhir diubah

6 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber zephyrproject.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-772: Missing Release of Resource after Effective Lifetime

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-cv4q-2j56-4wqf exploit · patch · advisory vendor