Zephyr’s IPv6 forwarding path does not decrement the hop‑limit on routed unicast packets, allowing packets that enter a routing loop to be forwarded indefinitely. This behavior enables an on‑path attacker to convert a transient Layer‑3 loop into a permanent forwarding storm, exhausting CPU and network bandwidth on the router and its adjacent links. The flaw therefore results in an availability denial of service; it does not provide confidentiality or integrity compromise. The weakness is a classic “Infinite Loop” error, corresponding to CWE‑835.

The vulnerability affects Zephyr Project’s Zephyr RTOS in releases from v1.8.0 through v4.4.1. Systems that have IPv6 routing enabled – indicated by CONFIG_NET_ROUTE and CONFIG_NET_ROUTING – are at risk. The flaw is confined to IPv6; IPv4 forwarding was added after v4.4.0 and is not affected. All configurations that enable IPv6 forwarding as a router are potentially vulnerable.

The CVSS base score of 5.8 indicates moderate severity, while the EPSS score of <1% implies a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must be able to induce or exploit a Layer‑3 loop on the network path; this is an on‑path attack that does not require special privileges beyond the ability to send traffic to the affected router. Once a loop is established, the absence of hop‑limit decrement causes an infinite forwarding cycle, leading to sustained resource exhaustion.