CVE-2020-17444

An issue was discovered in picoTCP 1.7.0. The routine for processing the next header field (and deducing whether the IPv6 extension headers are valid) doesn't check whether the header extension length field would overflow. Therefore, if it wraps around to zero, iterating through the extension headers will not increment the current data pointer. This leads to an infinite loop and Denial-of-Service in pico_ipv6_check_headers_sequence() in pico_ipv6.c.

• CWE-20
• CWE-190
• CWE-835

• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource
• https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01Third Party Advisory, US Government Resource
• https://www.kb.cert.org/vuls/id/815128Third Party Advisory, US Government Resource

Published

Dec 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17439An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…8.3
• CVE-2020-1744A flaw was found in keycloak before version 9.0.1. When conf…5.6
• CVE-2020-17440An issue was discovered in uIP 1.0, as used in Contiki 3.0 a…7.5
• CVE-2020-17441An issue was discovered in picoTCP 1.7.0. The code for proce…9.1
• CVE-2020-17442An issue was discovered in picoTCP 1.7.0. The code for parsi…7.5
• CVE-2020-17443An issue was discovered in picoTCP 1.7.0. The code for creat…7.5
• CVE-2020-17445An issue was discovered in picoTCP 1.7.0. The code for proce…7.5
• CVE-2020-17446asyncpg before 0.21.0 allows a malicious PostgreSQL server t…9.8
• CVE-2020-17447Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17448Telegram Desktop through 2.1.13 allows a spoofed file type t…7.8
• CVE-2020-17449PHP-Fusion 9.03 allows XSS via the error_log file.5.4
• CVE-2020-1745A file inclusion vulnerability was found in the AJP connecto…9.8