Description
On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the



ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated



peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing



ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first



packet.
Published: 2026-09-29
Score: 8.8 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 29 Sep 2026 18:00:00 +0000

Type Values Removed Values Added
Description On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the total record length instead of the remaining bytes. An unauthenticated peer drives an OOB source read of up to 255 bytes, and those bytes are echoed verbatim into the outgoing ServerHello, disclosing adjacent process memory over the network. The crash variant fires on the first packet.
Weaknesses CWE-125
References
Metrics cvssV4_0

{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: eclipse

Published:

Updated: 2026-09-29T17:39:31.083Z

Reserved: 2026-09-29T16:15:08.869Z

Link: CVE-2026-102712

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-29T18:17:10.320

Modified: 2026-09-29T19:00:16.623

Link: CVE-2026-102712

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses