DEBIAN-CVE-2026-120831: Medium severity debian/libslirp vulnerability

Published Nov 3, 2026

Updated

A flaw was found in libslirp in ifoutput(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service.

Affected Software

3 affected components

debian/libslirp*

Event History

Nov 3, 2026

CVE Published

via OSV·02:16 AM

Data Sourced

via OSV·02:16 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Deployments using Debian's libslirp are affected when a guest can generate burst network traffic through the vulnerable networking path. The reported impact is a crash of the host networking process.

Does exploitation require credentials or user interaction?

No. The supplied vector indicates adjacent-network attack access, low complexity, no privileges required, and no user interaction.

What is the expected security impact?

The reported impact is availability only: corruption of queue pointers can crash the host networking process. No confidentiality or integrity impact is listed.

DEBIAN-CVE-2026-120831: Medium severity debian/libslirp vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Does exploitation require credentials or user interaction?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial of service?

Does exploitation require credentials or user interaction?

What is the expected security impact?