CVE-2026-127124

P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the response. Repeated fragments or requests with different activity UUIDs exhaust the available sessions, one UDP packet per session. Once they are exhausted the device no longer answers a Connect request until it is restarted. An unauthenticated attacker with ADJACENT network access can use this to cause a denial of service.

• CWE-772

• https://rt-labs.com/wp-content/uploads/2026/11/RRTL-261109-01.pdf

Published

Nov 13, 2026

Last Modified

Nov 13, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-127111SOGo before 5.12.13 contains an improper restriction of exce…7.4
• CVE-2026-127119Unverified ownership of the default cluster log location in …5.3
• CVE-2026-127120A vulnerability was found in Governikus AusweisApp Mobile up…4.3
• CVE-2026-127121SOGo before 5.12.13 contains an improper cryptographic signa…6.5
• CVE-2026-127122P-Net before 1.0.4 does not check the number of MCR request …7.2
• CVE-2026-127123P-Net before 1.0.4 releases the Application Relationship of …6
• CVE-2026-127125P-Net before 1.0.4 aborts the Application Relationship of an…6
• CVE-2026-12713The WPCargo Track & Trace WordPress plugin before 8.0.4 does…9.1
• CVE-2026-127131SOGo before 5.12.13 contains a missing rate limiting vulnera…7.4
• CVE-2026-127135SOGo before 5.12.13 contains a Sieve script injection vulner…4.3
• CVE-2026-127141SOGo before 5.12.13 contains a denial of service vulnerabili…6.5
• CVE-2026-127145SOGo before 5.12.13 contains a server-side request forgery v…4.3