CVE-2026-23457

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23457
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary. For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser. Fix this by changing clen to unsigned long to match the return type of simple_strtoul(), and reject Content-Length values that exceed the remaining TCP payload length.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383 Patch
https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659 Patch
https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9 Patch
https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027 Patch
https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f Patch
https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015 Patch
https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873 Patch
https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c Patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
History

24 Jul 2026, 22:10

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: netfilter: nf_conntrack_sip: corrección de la truncación u32 de Content-Length en sip_help_tcp() sip_help_tcp() analiza la cabecera SIP Content-Length con simple_strtoul(), que devuelve unsigned long, pero almacena el resultado en unsigned int clen. En sistemas de 64 bits, los valores que exceden UINT_MAX se truncan silenciosamente antes de calcular el límite del mensaje SIP. Por ejemplo, Content-Length 4294967328 (2^32 + 32) se trunca a 32, provocando que el analizador calcule erróneamente dónde termina el mensaje actual. El bucle entonces trata los datos restantes en el segmento TCP como un segundo mensaje SIP y lo procesa a través del analizador SDP. Se corrige esto cambiando clen a unsigned long para que coincida con el tipo de retorno de simple_strtoul(), y rechazando los valores de Content-Length que exceden la longitud restante de la carga útil TCP.

14 Jul 2026, 13:18

Type Values Removed Values Added
References
  • () https://cert-portal.siemens.com/productcert/html/ssa-019113.html -
  • () https://cert-portal.siemens.com/productcert/html/ssa-082556.html -

26 May 2026, 14:40

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383 - () https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383 - Patch
References () https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659 - () https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659 - Patch
References () https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9 - () https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9 - Patch
References () https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027 - () https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027 - Patch
References () https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f - () https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f - Patch
References () https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015 - () https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015 - Patch
References () https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873 - () https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873 - Patch
References () https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c - () https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c - Patch

27 Apr 2026, 14:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.6

18 Apr 2026, 09:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f -
  • () https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873 -

03 Apr 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-03 16:16

Updated : 2026-07-24 22:10

NVD link : CVE-2026-23457

Mitre link : CVE-2026-23457

CVE.ORG link : CVE-2026-23457

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo