CVE-2026-123205: accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql

Published Nov 5, 2026

Updated

accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOGMAXSIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade accel-ppp to a version that resolves this vulnerability.
Fixed in 1.15.0

Event History

Nov 5, 2026

CVE Published

via MITRE·06:16 PM

Data Sourced

via MITRE·06:16 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

Deployments using the tcp, syslog, or pgsql log targets with verbose logging enabled are exposed when an attacker is within the configured client-ip-range. The issue affects accel-ppp versions before 1.15.0.

What does an attacker need to send?

An unauthenticated remote peer can send an L2TP Start-Control-Connection-Request containing many string AVPs. The oversized resulting log line can exceed LOG_MAX_SIZE and overflow a fixed heap buffer.

What is the likely impact of exploitation?

Successful exploitation can corrupt heap memory and crash the accel-ppp daemon. The provided severity vector indicates high availability impact and low integrity impact, with no confidentiality impact.

What can be done if upgrading is not immediately possible?

Disable verbose logging and restrict the configured client-ip-range so untrusted peers cannot send L2TP control requests. These steps address the stated conditions required to trigger the oversized log line.

CVE-2026-123205: accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What does an attacker need to send?

What is the likely impact of exploitation?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to remote exploitation?

What does an attacker need to send?

What is the likely impact of exploitation?

What can be done if upgrading is not immediately possible?