CVE-2026-115793

The record

P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that names an unknown interface or object UUID, and does not start a timeout for it. Repeated requests with different activity UUIDs exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Endpoint Mapper Lookup and Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.

Affected packages

Related vulnerabilities

• CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component of… CWE-772
• CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session… CWE-772
• CVE-2026-118262 Echo is a Go web framework. CWE-772
• CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or… CWE-772
• CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
• CVE-2026-104031 A flaw was found in SSSD. CWE-772
• CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
• CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772