high · CVSS v3 7.5

CVE-2026-120596

A high-severity denial-of-service flaw exists in the TCP options parser of Nut/Net TCP/IP stack used in Nut/OS up to 5.1. An unauthenticated

Overview

A high-severity denial-of-service flaw exists in the TCP options parser of Nut/Net TCP/IP stack used in Nut/OS up to 5.1. An unauthenticated attacker can send a crafted TCP segment that triggers an infinite loop, blocking all TCP services on the device until reboot. This impacts any device running Nut/OS with open TCP ports.

Description

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.

Impact

Confidentiality: not directly affected. Integrity: not directly affected. Availability: critical, as the flaw causes a permanent denial of service on TCP services until reboot. Defenders: network device operators, embedded system administrators, and IoT security teams must be aware that any device running Nut/OS with open TCP ports is vulnerable.

Remediation

Apply the official Nut/OS 5.1 patch or upgrade to a newer, non-vulnerable release. If patching is not immediately possible, block inbound traffic to the vulnerable device’s TCP ports using firewall rules or isolate the device on a separate VLAN. Monitor for abnormal CPU usage or TCP processing stalls and schedule a reboot if services become unresponsive.

Risk context

Severity is high with a CVSS v3 score of 7.5. No EPSS data is available, but the flaw can be exploited remotely without authentication, making it a significant risk for exposed devices.

Affected products

  • Nut/OS 5.1
  • Nut/OS 5.0
  • Nut/OS 4.9
  • Nut/OS 4.8
  • Nut/OS 4.7
  • Nut/OS 4.6
  • Nut/OS 4.5
  • Nut/OS 4.4

Scores

Severity
high
CVSS v2
7.8
CVSS v3
7.5
CVSS v4
—
EPSS
—

DoS TCP Nut/OS Network Denial-of-service Embedded High severity

← All CVEs

Related CVEs

high

CVE-2026-119301

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (also published as awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read any table that a separate, more privileged principal can access and write to the table that principal is updating via a crafted column name. To remediate this issue, users should upgrade to version 3.17.1 or later.

View analysis

high

CVE-2026-120830

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container.

View analysis

high

CVE-2026-120833

Labbench versions prior to 0.46.1 deserialize untrusted .p or .pickle files using pandas.read_pickle, enabling arbitrary code execution when a user loads such files. The flaw allows attackers to run malicious code on the host system. It is a high‑severity vulnerability that can compromise confidentiality, integrity, and availability of affected installations.

View analysis

high

CVE-2026-107441

An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

View analysis