CVE-2026-45182

LowCVSS 2.2/10Last modified Jul 24, 2026

Description

GrapheneOS before 2026050400 allows attackers to discover the real IP address of a VPN user as a consequence of a registerQuicConnectionClosePayload optimization, because an application can let system_server transmit UDP traffic on its behalf. This occurs when the "Block connections without VPN" and "Always-on VPN" settings are enabled.

Metrics

CVSS 3.1 2.2/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-441

Affected software

Vendor	Product	Versions
GrapheneOS	GrapheneOS	< 2026050400

References

Timeline

Published: May 9, 2026
Last modified: Jul 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-451846.5Kdenlive before 26.04.1 allows dangerous proxy parameters when an attacker-controlled project file is used.CVE-2026-451859.8Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path. It is triggered CVE-2026-451867.5In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized cr CVE-2026-451876.5Improper Authorization vulnerability in Apache OFBiz Webtools. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to CVE-2026-451882.4Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommend CVE-2026-45193.3The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. N CVE-2026-451906.5Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. In CVE-2026-451916.5Net::CIDR::Lite versions before 0.24 for Perl does not properly consider extraneous zero characters in CIDR mask values, which may allow IP CVE-2026-451926.5A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allowed an authenticated UI/API user with Connect CVE-2026-451957.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a memory read or write outs CVE-2026-451967.8Kernel software installed and running inside a Host VM may post improper commands to the GPU Firmware to trigger a GPU register access which CVE-2026-451972.5Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data o