CVE-2026-127124: RPC session pool exhausted by unfinished fragmented requests
P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the response. Repeated fragments or requests with different activity UUIDs exhaust the available sessions, one UDP packet per session. Once they are exhausted the device no longer answers a Connect request until it is restarted. An unauthenticated attacker with ADJACENT network access can use this to cause a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
P-Netto a version that resolves this vulnerability.Fixed in 1.0.4
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
P-Net versions before 1.0.4 are affected. Exploitation requires adjacent-network access because the attack is delivered using UDP packets to the target's RPC service.
Does exploitation require credentials or user interaction?
No. An unauthenticated attacker can trigger the condition, and no user interaction is required.
What happens when the attack succeeds?
Each unfinished fragmented request or request using a different activity UUID can retain an RPC session. After available sessions are exhausted, the device stops answering Connect requests until it is restarted.
Is there a workaround if the device cannot be updated immediately?
The provided information identifies adjacent-network access as a prerequisite. Restricting untrusted hosts from reaching the device's UDP RPC service can reduce exposure until an update is applied.
How can an operator recognize that the device may be under attack or affected?
A device that no longer responds to Connect requests and resumes doing so only after a restart may have exhausted its RPC session pool. The issue can be triggered with as little as one UDP packet per retained session.