CVE-2023-35847

HighCVSS 7.5

Published: 19/06/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.59%

43th percentile - higher than 43% of all known CVEs

Summary

VirtualSquare picoTCP (also known as PicoTCP-NG) through version 2.1 does not have an MSS lower bound, meaning it could be set to zero.

Risk Assessment

The lack of an MSS lower bound may lead to performance and stability issues with TCP connections, potentially affecting applications relying on this protocol.

Recommendation

It is recommended to upgrade to a newer version of picoTCP that implements appropriate MSS constraints.

Other vulnerabilities in VirtualSquare picoTCP

CVE-2023-35849High
VirtualSquare picoTCP through version 2.1 does not properly check whether header sizes would result in accessing data outside of a packet.

Original NVD description (English source)

VirtualSquare picoTCP (aka PicoTCP-NG) through 2.1 does not have an MSS lower bound (e.g., it could be zero).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS