CVE-2026-56099

MediumCVSS 5.3/10Last modified Oct 26, 2026

Description

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
openbsd	src	< 6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd

References

https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfdPatch
https://pop.argus-systems.ai/advisory/adv-040.htmlExploit, Patch, Third Party Advisory
https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-inputThird Party Advisory
http://seclists.org/fulldisclosure/2026/Jun/17Exploit, Mailing List, Patch, Third Party Advisory
http://www.openwall.com/lists/oss-security/2026/06/19/3Exploit, Mailing List, Patch, Third Party Advisory

Timeline

Published: Jun 18, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-56108.8A vulnerability has been found in Belkin F9K1015 1.00.10. Affected by this issue is the function formWISP5G of the file /goform/formWISP5G. CVE-2026-561008.1SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attacke CVE-2026-561015.3OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80 CVE-2026-561048.2Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated CVE-2026-561096.8The Advanced Linux Sound Architecture (ALSA) library before 1.2.16.1 contains a double-free vulnerability in parse_def() in src/conf.c that CVE-2026-56118.8A vulnerability was found in Belkin F9K1015 1.00.10. This affects the function formCrossBandSwitch of the file /goform/formCrossBandSwitch. CVE-2026-561119.1Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, contains an out-of-bounds write vulnera CVE-2026-561136.5dhcpcd through 10.3.2, fixed in commit 5733d3c, contains a heap use-after-free vulnerability that allows unauthenticated same-link attackers CVE-2026-561146.5dhcpcd through 10.3.2, fixed in commit 2f00c7b, contains a one-byte stack out-of-bounds write vulnerability in dhcp6_makemessage() in src/dh CVE-2026-561158.8Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrat CVE-2026-561166.5dhcpcd through 10.3.2, fixed in commit 708b4a5, contains a memory leak vulnerability in the IPv6 Router Advertisement route information hand CVE-2026-561175.5dhcpcd through 10.3.2, fixed in commit 78ea09e, contains a heap use-after-free vulnerability in the control socket handling within src/contr