CVE-2026-119600

The record

tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.

Affected packages

Related vulnerabilities

• CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
• CVE-2026-115794 P-Net before 1.0.3 passes the application alarm callback a data length derived from the… CWE-130
• CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked… CWE-130
• CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length… CWE-130
• CVE-2026-116013 OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability… CWE-130
• CVE-2026-114646 A data-validation flaw exists in the BSON handling and binary serialization path of the… CWE-130