CVE-2026-0918

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
Jan 27, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-09197.5The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalCVE-2026-09209.8The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Administrative User Creation in all versions up to, and includCVE-2026-09247.0BuhoCleaner contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functioCVE-2026-09254.9Tanium addressed an improper input validation vulnerability in Discover.CVE-2026-09269.8The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parametCVE-2026-09275.3The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorizCVE-2026-09294.3The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create formCVE-2026-09304.3Potential read out of bounds case with wolfSSHd on Windows while handling a terminal resize request. An authenticated user could trigger theCVE-2026-09316.9Denial-of-service vulnerability in M-Files Server versions before 26.5.16015.3 allows an authenticated admin user to cause the M-Files ServeCVE-2026-09327.3Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server befoCVE-2026-09339.9SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because tCVE-2026-09343.8GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that