CVE-2026-8369: Improper Input Validation in OpenThread NAT64 Translator
Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security checks via crafted IPv4 packets with options.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenThreadto a version that resolves this vulnerability.Patch commit 26a882d - Configuration
Disable the NAT64 translator in OpenThread if it is not required until the fix (commit 26a882d) is applied.
OpenThread NAT64 translator enabled = false - Compensating control
Block or filter IPv4 packets containing options from adjacent IPv4 networks (or otherwise restrict access to the NAT64 translator) to prevent crafted IPv4 packets from reaching the translator.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8369?
CVE-2026-8369 is considered a high severity vulnerability due to its impact on network security.
How do I fix CVE-2026-8369?
To fix CVE-2026-8369, update OpenThread to the latest version after commit 26a882d.
What kind of attack is possible with CVE-2026-8369?
An attacker can inject corrupted IPv6 packets into the Thread mesh or bypass security measures in the NAT64 translator.
Which software is affected by CVE-2026-8369?
OpenThread versions before commit 26a882d are vulnerable to CVE-2026-8369.
Who are the authors of the vulnerable software related to CVE-2026-8369?
The vulnerability CVE-2026-8369 is found in the OpenThread software developed by The OpenThread Authors.