Description
A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.
Published: 2026-11-02
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch Now
AI Analysis

Impact

A single malformed TCP segment containing an unknown TCP option with a length byte of zero causes the Nut/Net TCP/IP stack to enter an infinite loop in its options parser. This loop permanently blocks the TCP processing thread, rendering all TCP‑based services on the affected device unusable until the system is rebooted. The flaw does not provide any direct data or control compromise, but it delivers a complete denial of service against any open TCP service.

Affected Systems

The Nut/Net TCP/IP stack bundled with Nut/OS versions up to 5.1, distributed by Ethernut / egnite GmbH, is affected. Any device running these firmware releases that accepts TCP traffic is vulnerable; the attack can target any open port on the device.

Risk and Exploitability

The vulnerability is remotely exploitable without authentication and requires only a single crafted packet. The CVSS score of 7.5 indicates a high severity scenario. Although an EPSS score is unavailable, the infinite loop nature means the service disruption is permanent until a reboot, making the risk high. The flaw is not listed in the CISA KEV catalog, and no specific mitigation is provided by the vendor, so the likelihood of exploitation remains significant for reachable devices.

Generated by OpenCVE AI on November 2, 2026 at 21:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Nut/OS to the latest release, which includes a fixed TCP options parser that guards against zero-length unknown options.
  • If an upgrade is not immediately possible, block or limit inbound TCP traffic to strictly the ports required for operation by a firewall or access control list, reducing the exposure to malicious packets.
  • Enable or implement runtime checks that validate the length field of TCP options before processing, ensuring that a length of zero does not trigger a loop; this addresses the underlying infinite‑loop weakness (CWE‑835).

Generated by OpenCVE AI on November 2, 2026 at 21:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-730

Mon, 02 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-730

Mon, 02 Nov 2026 18:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-835
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 17:15:00 +0000

Type Values Removed Values Added
Description A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.
Title CVE-2026-120596
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: certcc

Published:

Updated: 2026-11-02T17:17:35.066Z

Reserved: 2026-11-02T16:58:49.331Z

Link: CVE-2026-120596

cve-icon Vulnrichment

Updated: 2026-11-02T17:17:28.470Z

cve-icon NVD

Status : Deferred

Published: 2026-11-02T17:17:40.003

Modified: 2026-11-02T19:35:33.347

Link: CVE-2026-120596

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T22:00:06Z

Weaknesses
  • CWE-835

    Loop with Unreachable Exit Condition ('Infinite Loop')