Description
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/snmp/snmp_msg.c of the component snmpv3 USM Handler. Performing a manipulation of the argument msgAuthenticationParameters results in stack-based buffer overflow. The attack may be initiated remotely. The patch is named 0c957ec03054eb6c8205e9c9d1d05d90ada3898c. It is suggested to install a patch to address this issue. Two separate issue reports were submitted to the project. Their processing was merged as a duplicate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | lwIP | 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.2.0, 2.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lwip | 2.2.1+dfsg1-5 | — |
| Debian 13 | lwip | 2.2.1+dfsg1-1+deb13u1 | — |
| Debian 12 | lwip | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | lwip | No fix yet | — |
| Ubuntu 25.10 | lwip | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | lwip | 2.2.1+dfsg1-4ubuntu0.1~esm1 | — |
| Ubuntu Pro 24.04 LTS | lwip | 2.2.0+dfsg1-6.1ubuntu0.1~esm1 | — |
| Ubuntu Pro 22.04 LTS | lwip | 2.1.3+dfsg1-1ubuntu0.1~esm1 | — |
| Ubuntu Pro 20.04 LTS | lwip | 2.1.2+dfsg1-4ubuntu0.1~esm1 | — |
References
- VDB-364474 | lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow vdb-entry technical-description
- VDB-364474 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-8836 | CVE Analysis and Report third-party-advisory
- Submit #829798 | lwIP 2.1.0 Stack-based Buffer Overflow third-party-advisory
- https://savannah.nongnu.org/bugs/?68055 broken-link
- https://cgit.git.savannah.gnu.org/cgit/lwip.git/commit/?id=0c957ec03054eb6c8205e9c9d1d05d90ada3898c broken-link patch
- https://github.com/lwip-tcpip/lwip/commit/0c957ec03054eb6c8205e9c9d1d05d90ada3898c patch
- https://savannah.nongnu.org/bugs/?68194 broken-link