CVE-2026-120596

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.

• CWE-835

• https://www.ethernut.de/en/download/index.html

Published

Nov 2, 2026

Last Modified

Nov 2, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-120574The SureCart plugin for WordPress is vulnerable to unauthent…8.1
• CVE-2026-120575The Photo Engine (Media Organizer & Lightroom) plugin for Wo…6.4
• CVE-2026-120577The FluentCart A New Era of eCommerce – Faster, Lighter, and…8.1
• CVE-2026-120578The AI Alt Text Generator plugin for WordPress is vulnerable…5.3
• CVE-2026-12058The connection confirmation pop-up of a specific feature in …5.3
• CVE-2026-12059The SSH service of CelloOS developed by Cellopoint has an Im…8.8
• CVE-2026-120597A vulnerability was identified in Welcart e-Commerce Plugin …4.3
• CVE-2026-1206The Elementor Website Builder plugin for WordPress is vulner…4.3
• CVE-2026-12060Heptabase developed by Hepta Platforms has a Exposed Dangero…6.5
• CVE-2026-120627The Private Internet Access Extension for Firefox contains a…
• CVE-2026-120630CrewAI contains an SSRF vulnerability caused by its SSRF gua…
• CVE-2026-120631CGI::Cookie versions from 4.67 before 5.00 for Perl allow de…