CVE-2026-110912High· 7.1▾ TwilightIn DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP p…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 7.1
none → high
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply() then uses these attacker-controlled values as memcpy lengths when copying from kernel buffers that are only 6 and 4 bytes long, resulting in an out-of-bounds read of kernel heap and stack memory that is copied into the ARP reply sent back to the requester. An unauthenticated attacker on the adjacent network can use a single crafted ARP request to disclose up to roughly 250 bytes of each type of kernel memory, including kernel pointers. This is expected to be fixed in the 6.6 stable release when that is available.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-5367High· 8.6A flaw was found in OVN (Open Virtual Network)
CVE-2026-92159Medium· 6.5F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications
CVE-2026-101962High· 7.5An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an attacker sending a specifically malformed BGP EVPN multicast update whi…
CVE-2026-102054Medium· 4.3An Improper Handling of Length Parameter Inconsistency vulnerability in L2ALM of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adjacent attacker to obtain stale PFE packet memory via VXLAN overlay-ping traffic…
CVE-2026-101994High· 7.1An Improper Handling of Length Parameter Inconsistency vulnerability in the l2ald daemon of Juniper Networks Junos OS and Junos OS Evolved allows an attacker who can control or impersonate a configured MC-LAG ICCP peer to disclose pr…
CVE-2026-101991Low· 3.1An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP-LS peer to cause heap data disclosure via a malformed UPD…