CVE-2026-120596

HighCVSS 7.5/10Last modified Nov 2, 2026

Description

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
Ethernut / egnite GmbH	Nut/Net TCP/IP Stack	Nut/OS 5.1

References

https://www.ethernut.de/en/download/index.html

Timeline

Published: Nov 2, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1205974.3A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_mes CVE-2026-12064.3The Elementor Website Builder plugin for WordPress is vulnerable to Incorrect Authorization to Sensitive Information Exposure in all version CVE-2026-120606.5Heptabase developed by Hepta Platforms has a Exposed Dangerous Method or Function vulnerability, allowing unauthenticated remote attackers t CVE-2026-120628.8Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plu CVE-2026-1206277.5The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA pro CVE-2026-1206309.1CrewAI contains an SSRF vulnerability caused by its SSRF guard and HTTP client, which both miss malicious content in URLs by checking opposi CVE-2026-1206317.5CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as a regex in parse. C CVE-2026-1206326.5CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related Content-Type. When a POST C CVE-2026-1206336.1CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and virtual_port. These take the CVE-2026-1206346.5CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the warningsToBrowser buffer. Warnings CVE-2026-1206358.1CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that differs from the RFCs. CVE-2026-1206366.1CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form. url(-abs