Loading story…
OpenBSD disclosed CVE-2026-56099, a medium-severity flaw in the MPLS subsystem that can expose kernel stack memory to a remote attacker when MPLS is enabled on an interface. The bug is in mpls_do_error() in sys/netmpls/mpls_input.c, where a crafted MPLS packet with 16 labels and no Bottom-of-Stack bit causes the kernel to copy 17 shim headers from a 16-entry local stack array, leaking 4 bytes of adjacent kernel stack data in an ICMP/MPLS error response.
The issue affects OpenBSD -current before the fix and traces back to code introduced in 2010 in the ICMP/MPLS error-handling path. Exploitation requires an attacker to send an MPLS frame with EtherType 0x8847, an outer label TTL of 1, and an IPv4 inner payload; researchers at Argus Systems reported the vulnerability, and OpenBSD corrected it by rejecting label stacks that reach the maximum depth without a BoS bit.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
OpenBSD fixed the MPLS over-read vulnerability by rejecting label stacks that reach the maximum depth without a Bottom-of-Stack bit set. The flaw affected OpenBSD -current prior to this fix.
Argus Systems reported a vulnerability in OpenBSD's MPLS error-handling path that can leak 4 bytes of adjacent kernel stack memory via a crafted MPLS packet. The issue was later tracked as CVE-2026-56099.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcegithub.com
Open sourceseclists.org
Open sourcepop.argus-systems.ai
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A remotely triggerable out-of-bounds read vulnerability was disclosed in `traceroute` 2.1.2, affecting MPLS extension parsing when the tool is run with `-e`. Researcher Mohamed Aziz Rahmouni reported that in `traceroute/traceroute.c`, the packet buffer pointer is advanced past the IP header after `recvmsg()`, but the packet length variable is not reduced before `handle_extensions()` is called. That mismatch can cause the parser to read past the actual received packet boundary and into uninitialized stack memory in `buf[1280]` when processing a crafted ICMP Time Exceeded response carrying MPLS extensions from an on-path network device. The researcher said the flaw was identified through manual code review and dynamic fuzzing, confirmed with a working proof of concept, and could be corrected with a one-line fix that subtracts the header length from the packet length after advancing the buffer pointer. traceroute maintainer Dmitry Butskoy acknowledged the report on the `oss-sec` mailing list and said he would review it within hours, while the disclosure followed a 90-day responsible disclosure timeline with public technical details planned unless a patch is released sooner.
Jun 29, 2026
OpenBSD fixed a high-severity authentication bypass in its PPP stack after researchers disclosed that the bug had existed since the original `sppp` code import from FreeBSD in 1999. The flaw affects `sppp_pap_input()` and all OpenBSD releases through 7.6 when the system is configured as a PAP authenticator on the PPPoE data path. By trusting attacker-controlled `name_len` and `passwd_len` values in `bcmp()` comparisons, the code could accept zero-length credentials as valid because a zero-length `bcmp()` returns success, allowing remote attackers to authenticate without legitimate credentials. The disclosure also described a secondary kernel heap over-read caused when a supplied username length exceeds the allocated size of the stored credential, a condition introduced after credential fields became dynamically allocated in 2009. Researchers said the bug could let an attacker intercept or read PPPoE traffic and could also allow a rogue PPPoE server to impersonate a legitimate server during mutual authentication. OpenBSD committed a fix to `-current` on 2026-06-14, and a proof of concept reportedly showed successful PAP authentication with empty credentials followed by establishment of a full network-layer link.
Jun 29, 2026
OpenBSD disclosed a local privilege-escalation vulnerability, tracked as **CVE-2026-57589**, in its System V semaphore implementation. The bug stems from an integer overflow in the `sys_semget()` handler that can lead to kernel memory corruption and allow a local user to escalate privileges to **root** under certain conditions. A fix was committed to **OpenBSD-current**, while patches for stable branches were still pending in the reporting cited. The flaw was reportedly identified during the **Patch the Planet** event focused on AI-assisted vulnerability research, and the same reporting also referenced separate OpenBSD findings affecting **IPsec/IPComp**, **NFS**, and the **pinsyscall** and **kbind** mechanisms.
Jul 16, 2026