CVE-2026-119600

MediumCVSS 4.8/10Last modified Nov 9, 2026

Description

tcpflow before 1.7.0 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-130

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
simsong	tcpflow	<= 1.6.1

References

Timeline

Published: Oct 30, 2026
Last modified: Nov 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1196016.1AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by sup CVE-2026-1196023.7libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to le CVE-2026-119618.1The User Registration & Membership WordPress plugin before 5.2.3 does not validate that the membership tier submitted during public registr CVE-2026-1196108.2A flaw was found in GStreamer's gst-plugins-good, specifically in the H.264 RTP depayloader element. When processing MTAP16 or MTAP24 multi-CVE-2026-1196135.3Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read in CVE-2026-1196158.8The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the pr CVE-2026-1196165.9The Noptin – Newsletter, New Post Notifications & Email Automation plugin for WordPress is vulnerable to Local File Inclusion in all version CVE-2026-1196188.1Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers()CVE-2026-1196197.3A vulnerability was found in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This affects the function my CVE-2026-119628.8The FileOrganizer WordPress plugin before 1.2.0 does not validate the file type on several of its file-management operations, allowing auth CVE-2026-1196207.3A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affe CVE-2026-1196254.3The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scope. A token confined to