CVE-2026-112200

The record

P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component of… CWE-772
• CVE-2026-115793 P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that… CWE-772
• CVE-2026-118262 Echo is a Go web framework. CWE-772
• CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or… CWE-772
• CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
• CVE-2026-104031 A flaw was found in SSSD. CWE-772
• CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
• CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772