Vulnerability DatabaseCVE-2026-119600
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2026-119600
Published:October 30, 2026
Updated:November 04, 2026
tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.
Related Resources (8)
https://github.com/simsong/tcpflow
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119600.json
https://nvd.nist.gov/vuln/detail/CVE-2026-119600
https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L781
https://www.vulncheck.com/advisories/tcpflow-through-1.6.1-out-of-bounds-read-via-tcp-demultiplexer-payload-length
https://hackmd.io/@haindpwn/tcpflow-ip-payload-length-oob-read
https://github.com/simsong/tcpflow/blob/tcpflow-1.6.1/src/tcpdemux.cpp#L747
https://github.com/simsong/tcpflow/issues/279
Do you need more information?
Contact Us
CVSS v4
Base Score:
6.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
PRESENT
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
NONE
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.8
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
LOW
Weakness Type (CWE)
Improper Handling of Length Parameter Inconsistency
CWE-130
EPSS
Base Score:
0.37