EUVD-2026-37938
GHSA-6qv5-f6m3-44g8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible with no authentication since MPLS frame delivery is protocol-level; only low confidentiality impact as the read leaks partial kernel stack data with no integrity or availability consequence.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.
AnalysisAI
Kernel stack memory disclosure in OpenBSD's MPLS input processing exposes arbitrary kernel stack contents to unauthenticated remote attackers via crafted MPLS frames. The flaw exists in mpls_do_error within sys/netmpls/mpls_input.c (revision 1.81), where a label-stack iterator lacked an upper-bounds guard, allowing a 16-label frame with no Bottom-of-Stack bit to drive an out-of-bounds read. A publicly available exploit exists per the Argus Systems advisory; this vulnerability is not confirmed as actively exploited in the CISA KEV catalog, and the CVSS 4.0 score is 6.9.
Technical ContextAI
MPLS (Multiprotocol Label Switching) uses a label stack embedded in network frames; each label carries a Bottom-of-Stack (BoS) bit to signal the final label. OpenBSD's mpls_do_error function in sys/netmpls/mpls_input.c processes these frames during error handling. The vulnerable code iterated over incoming labels using a counter (nstk) without bounding it against MPLS_INKERNEL_LOOP_MAX - the kernel's defined maximum label depth of 16. When a crafted packet presents exactly 16 labels with no BoS bit set, the iterator overruns the valid label stack into adjacent kernel stack memory, constituting a CWE-125 Out-of-Bounds Read. The commit diff confirms the fix: a guard if (nstk >= MPLS_INKERNEL_LOOP_MAX) { m_freem(m); return (NULL); } was inserted before the unbounded iteration path in revision 1.82. The affected CPE is cpe:2.3:a:openbsd:src:*:*:*:*:*:*:*:*, covering all OpenBSD src versions prior to commit 6a23123 on 2026-06-18.
RemediationAI
Apply OpenBSD source commit 6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd (https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd), which introduces the nstk >= MPLS_INKERNEL_LOOP_MAX guard in mpls_do_error and rebuilds the kernel. No specific patched release version number is independently confirmed from the available data; operators should apply the commit directly against their source tree. As a compensating control for systems where immediate patching is impractical, disabling MPLS forwarding on any interface reachable by untrusted hosts removes the exposure path - trade-off is loss of MPLS routing capability on those interfaces. Blocking MPLS EtherType (0x8847/0x8848) at perimeter ingress on non-MPLS-transit links is an additional containment measure with no functional impact on non-MPLS traffic. The Argus Systems advisory at https://pop.argus-systems.ai/advisory/adv-040.html provides exploit-level detail useful for validating detection coverage.
OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. Rated medium se
sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static
The kbdint_next_device function in auth2-chall.c in sshd in OpenSSH through 6.9 does not properly restrict the processin
The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password a
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
httpd in OpenBSD allows remote attackers to cause a denial of service (memory consumption) via a series of requests for
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. Rated medium severity (CVSS 6.8), this
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote serv
Multiple CRLF injection vulnerabilities in session.c in sshd in OpenSSH before 7.2p2 allow remote authenticated users to
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or e
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today