CVE-2026-60060
Medium · 6.3CVSS
6.3
EPSS
0.3%
Published
Jul 17, 2026
CISA due date
—
The record
Improper Handling of Length Parameter Inconsistency (CWE-130) vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory regions may be transmitted to the server, and Tera Term may behave unexpected or terminate abnormally.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119600 tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows… CWE-130
- CVE-2026-119279 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
- CVE-2026-119277 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
- CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-130
- CVE-2026-115794 P-Net before 1.0.3 passes the application alarm callback a data length derived from the… CWE-130
- CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked… CWE-130
- CVE-2026-114597 In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length… CWE-130
- CVE-2026-116013 OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability… CWE-130