Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-119600 (GCVE-0-2026-119600)

Vulnerability from cvelistv5 – Published: 2026-10-30 13:18 – Updated: 2026-11-09 19:18

Title

tcpflow < 1.7.0 Out-of-Bounds Read via TCP Demultiplexer Payload Length

Summary

tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

4.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-04 22:28 UTC

CWE

CWE-130 - Improper Handling of Length Parameter Inconsistency

Assigner

VulnCheck CNA

References

8 references

URL	Tags
https://github.com/simsong/tcpflow/issues/279	issue-tracking
https://github.com/simsong/tcpflow/blob/tcpflow-1…	technical-description
https://github.com/simsong/tcpflow/blob/tcpflow-1…	technical-description
https://hackmd.io/@haindpwn/tcpflow-ip-payload-le…	third-party-advisory
https://github.com/simsong/tcpflow	product
https://www.vulncheck.com/advisories/tcpflow-out-…	third-party-advisory
https://github.com/simsong/tcpflow/releases/tag/v1.7.0	release-notespatch
https://github.com/simsong/tcpflow/pull/280	issue-trackingpatch

Impacted products

1 product

Vendor	Product	Version
simsong	tcpflow	Affected: 0 , ≤ 1.6.1 (semver) Unaffected: 1.7.0 (semver)

Date Public

2026-10-22 00:00

Credits

HaiND from the Post and Telecommunication Institute of Technology

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-119600",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T22:28:41.522672Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-04T22:28:53.487Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "tcpflow",
          "repo": "https://github.com/simsong/tcpflow",
          "vendor": "simsong",
          "versions": [
            {
              "lessThanOrEqual": "1.6.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "1.7.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "HaiND from the Post and Telecommunication Institute of Technology"
        }
      ],
      "datePublic": "2026-10-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-130",
              "description": "Improper Handling of Length Parameter Inconsistency",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:18:39.240Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/simsong/tcpflow/issues/279"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L781"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L747"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://hackmd.io/@haindpwn/tcpflow-ip-payload-length-oob-read"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/simsong/tcpflow"
        },
        {
          "name": "VulnCheck Advisory: tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/tcpflow-out-of-bounds-read-via-tcp-demultiplexer-payload-length"
        },
        {
          "name": "Fixed Release Tag",
          "tags": [
            "release-notes",
            "patch"
          ],
          "url": "https://github.com/simsong/tcpflow/releases/tag/v1.7.0"
        },
        {
          "name": "Pull Request",
          "tags": [
            "issue-tracking",
            "patch"
          ],
          "url": "https://github.com/simsong/tcpflow/pull/280"
        }
      ],
      "title": "tcpflow \u003c 1.7.0 Out-of-Bounds Read via TCP Demultiplexer Payload Length",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-119600",
    "datePublished": "2026-10-30T13:18:19.167Z",
    "dateReserved": "2026-10-30T11:46:46.502Z",
    "dateUpdated": "2026-11-09T19:18:39.240Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-25061 (GCVE-0-2026-25061)

Vulnerability from cvelistv5 – Published: 2026-01-29 21:42 – Updated: 2026-02-10 20:14

Title

tcpflow has TIM Element OOB Write in wifipcap

Summary

tcpflow is a TCP/IP packet demultiplexer. In versions up to and including 1.61, wifipcap parses 802.11 management frame elements and performs a length check on the wrong field when handling the TIM element. A crafted frame with a large TIM length can cause a 1-byte out-of-bounds write past `tim.bitmap[251]`. The overflow is small and DoS is the likely impact; code execution is potential, but still up in the air. The affected structure is stack-allocated in `handle_beacon()` and related handlers. As of time of publication, no known patches are available.

Severity

5.5 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-01-30 14:47 UTC

CWE

CWE-787 - Out-of-bounds Write