CVE-2026-41285

Katalog CVE

CVSS 4.3 · Medium EPSS 0,25%

Kerentanan Improper Validation of Specified Quantity in Input pada openbsd. Skor CVSS 3.1 4.3 (Medium) menurut mitre.org.

Deskripsi (NVD)

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber mitre.org
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1284: Improper Validation of Specified Quantity in Input
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 15,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f patch
• https://www.openbsd.org/errata78.html product · release notes
• https://www.rfc-editor.org/rfc/rfc4861#section-4.6 not applicable