CVE-2026-55706
MediumCVSS 5.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In OpenBSD before commit 076e2b1, the sppp_pap_input function in sys/net/if_spppsubr.c allows authentication bypass via certain zero values for lengths.
Risk Assessment
An attacker can gain unauthorized access to the PPP network, leading to data confidentiality and integrity breaches.
Recommendation
Immediately update OpenBSD to a version containing commit 076e2b1 or later.
Other vulnerabilities in OpenBSD
See all- CVE-2017-1000372Critical
A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.
- CVE-2026-57589High
In the OpenBSD kernel up to version 7.9, a use-after-free vulnerability exists in sys/kern/sysv_sem.c, allowing local privilege escalation to root. The issue occurs after a context switch following the tsleep call in sys_semget().
- CVE-2026-56099Medium
A vulnerability in OpenBSD before commit 6a23123 (2026-06-18) in the mpls_do_error function within sys/netmpls/mpls_input.c allows remote attackers to read kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
- CVE-2023-40216Medium
OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. This could cause incorrect memory access and a kernel crash after receiving crafted DCS or CSI terminal escape sequences.
- CVE-1999-0481Medium
CVE-1999-0481 vulnerability concerns the 'poll' service in OpenBSD, which can lead to a denial of service.
- CVE-1999-0485Low
Remote attackers can cause a system crash through ipintr() in ipq in OpenBSD.
- CVE-1999-0062High
The chpass command in OpenBSD allows a local user to gain root access through file descriptor leakage.
Original NVD description (English source)
sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.