CVE-2026-34124

MediumCVSS 6.5/10Last modified Jul 24, 2026

Description

A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw request path but does not account for path expansion performed during normalization. An attacker on the adjacent network may send a crafted HTTP request to cause buffer overflow and memory corruption, leading to system interruption or device reboot.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
TP-Link Systems Inc.	Tapo C520WS v2.6	< 1.2.4 Build 260326 Rel.24666n

References

https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-NotesRelease Notes
https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-NotesRelease Notes
https://www.tp-link.com/us/support/faq/5047/Vendor Advisory

Timeline

Published: Apr 2, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-341267.5TP-Link has identified a vulnerability in Tapo L535E v1.0 and v3.0, Tapo P300 v1.0, and Tapo D100C v1.0, where Bluetooth communication durin CVE-2026-341274.8A stored cross-site scripting (XSS) vulnerability has been identified in the web management interface of TP-Link's TL-SG108PE v5 switch due CVE-2026-34139.8A flaw has been found in itsourcecode University Management System 1.0. This vulnerability affects unknown code of the file /admin_single_st CVE-2026-341487.5Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/CVE-2026-341493.3Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, DatabaseBackupJ CVE-2026-34158.7The XML and schema validation functionalities within the SchemaValidator Mediator process XML input as part of validation flows. Under certa CVE-2026-341507.5Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, CVE-2026-341518.2XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double CVE-2026-341528.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, pre-deployment CVE-2026-341538.8Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, LocalFileVolume CVE-2026-341545.3Discourse is an open-source discussion platform. In versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1, a vulnerability i CVE-2026-341555.3RAUC controls the update process on embedded Linux systems. Prior to version 1.15.2, RAUC bundles using the 'plain' format exceeding a paylo