CVE-2026-127122

P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past the end of the array, into the rest of the Application Relationship and, with more blocks, into the following one. The written data comes from the request. No established Application Relationship is needed, and the attacker requires ADJACENT network access. Builds with PNET_OPTION_MC_CR disabled are not affected.

• CWE-787

• https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127102In Eclipse BaSyx Go Components versions up to and including …7.1
• CVE-2026-127109A code injection vulnerability in promzard’s template-loadin…
• CVE-2026-127111SOGo before 5.12.13 contains an improper restriction of exce…7.4
• CVE-2026-127119Unverified ownership of the default cluster log location in …5.3
• CVE-2026-127120A vulnerability was found in Governikus AusweisApp Mobile up…4.3
• CVE-2026-127121SOGo before 5.12.13 contains an improper cryptographic signa…6.5
• CVE-2026-127123P-Net before 1.0.4 releases the Application Relationship of …6
• CVE-2026-127124P-Net before 1.0.4 keeps the RPC session that is allocated f…7.1
• CVE-2026-127125P-Net before 1.0.4 aborts the Application Relationship of an…6
• CVE-2026-12713The WPCargo Track & Trace WordPress plugin before 8.0.4 does…9.1
• CVE-2026-127131SOGo before 5.12.13 contains a missing rate limiting vulnera…7.4
• CVE-2026-127135SOGo before 5.12.13 contains a Sieve script injection vulner…4.3