lwIP vulnerabilities

CVEs whose affected-version data names the lwIP package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-112062Medium· 5.9

today

lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler

lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can sen…

▾ SunlitlwIP · lwIPvia CVEORG