CVE-2026-4247
HighSummary
Podatność CVE-2026-4247 dotyczy wycieku mbuf w systemie FreeBSD, gdy funkcja tcp_respond() nieprawidłowo obsługuje pakiety challenge ACK. Atakujący mogą wykorzystać tę lukę, wysyłając odpowiednio skonstruowane pakiety, co prowadzi do wycieku pamięci dla każdego nadmiarowego pakietu.
Risk Assessment
Organizacja narażona jest na wyciek pamięci, co może prowadzić do obniżenia wydajności systemu oraz potencjalnego wyczerpania zasobów. Atakujący mogą wykorzystać tę lukę, aby przeprowadzić ataki DoS na dotknięte maszyny FreeBSD.
Recommendation
Zaleca się aktualizację systemu FreeBSD do najnowszej wersji, która zawiera poprawki dla tej podatności. Dodatkowo, warto monitorować ruch sieciowy w celu wykrywania podejrzanych pakietów mogących wykorzystać tę lukę.
Related vulnerabilities
- CVE-2026-90898Critical
Bifrost registers MCP clients through its management API, where a stdio client is a command plus args that is started immediately upon client addition, with no MCP handshake required. Authentication is disabled by default (governance.auth_config.is_enabled=false), meaning every caller is treated as a local admin. A single unauthenticated POST /api/mcp/client is enough to run a program as the Bifrost process user (appuser on the official image).
- CVE-2026-90703Critical
A vulnerability has been found in D-Link DWR-M921 1.1.52 in the system function of the file /boafrm/formDiskCreateShare. Manipulation of the folderpath argument leads to OS command injection. The attack can be launched remotely, and the exploit has been publicly disclosed and may be used.
- CVE-2026-90702Critical
A flaw has been found in D-Link DWR-M921 1.1.52 in the system function of the file /boafrm/formDiskFormat. Manipulation of the partition argument causes OS command injection. The attack may be initiated remotely, and the exploit has been published and may be used.
- CVE-2026-90699Critical
A weakness has been identified in D-Link DWR-M920 1.1.7 affecting the sub_41E60C function of the file /boafrm/formPinManageSetup. Manipulation of the newPin argument causes OS command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.
- CVE-2026-90693Critical
A flaw has been found in D-Link DIR-878 120B05 impacting the SetWan3Settings function of the WAN Settings component. Manipulation of the Primary/Secondary argument causes a stack-based buffer overflow. Remote exploitation of the attack is possible.
- CVE-2026-90692Critical
A vulnerability was detected in D-Link DIR-878 120B05 affecting the SetDynamicDNSIPv6Settings function of the Dynamic DNS IPv6 Settings component. Manipulation of the IPv6Address/Hostname argument results in a stack-based buffer overflow. The attack may be launched remotely.
- CVE-2026-85192Critical
The Joomla Conditional Content extension (regularlabs.com) in versions < 8.0.0 allows authenticated, privileged remote code execution. Conditional Content Pro accepts inline PHP Condition Rules in article syntax, and in affected versions the PHP is passed to the Conditions evaluator without checking who authored the article. Joomla's normal Author text filter preserves the syntax, so publishing the article causes the code to run as the web-server process.
- CVE-2026-82787Critical
A missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication.
- CVE-2026-90680Critical
A stack-based buffer overflow vulnerability was discovered in D-Link DIR-823G version 1.0.2B05_20181207, in the strcpy function of /HNAP1/SetStaticRouteSettings (HNAP1 component). Manipulating the PAddress/SubnetMask/Gateway arguments triggers the overflow. The attack can be launched remotely.
- CVE-2026-90608Critical
A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.
Original NVD description (English source)
When a challenge ACK is to be sent tcp_respond() constructs and sends the challenge ACK and consumes the mbuf that is passed in. When no challenge ACK should be sent the function returns and leaks the mbuf. If an attacker is either on path with an established TCP connection, or can themselves establish a TCP connection, to an affected FreeBSD machine, they can easily craft and send packets which meet the challenge ACK criteria and cause the FreeBSD host to leak an mbuf for each crafted packet in excess of the configured rate limit settings i.e. with default settings, crafted packets in excess of the first 5 sent within a 1s period will leak an mbuf. Technically, off-path attackers can also exploit this problem by guessing the IP addresses, TCP port numbers and in some cases the sequence numbers of established connections and spoofing packets towards a FreeBSD machine, but this is harder to do effectively.