CVE-2026-120596

The record

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.

Affected packages

Related vulnerabilities

• CVE-2026-63475 isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. CWE-835
• CVE-2026-121261 A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. CWE-835
• CVE-2026-121400 FreeRDP before 3.32.2 contains a denial-of-service vulnerability in… CWE-835
• CVE-2026-119738 The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService)… CWE-835
• CVE-2026-120458 Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in… CWE-835
• CVE-2026-120251 imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in… CWE-835
• CVE-2026-120194 A flaw was found in json-glib. CWE-835
• CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-835