UBUNTU-CVE-2026-119600: Medium severity ubuntu/tcpflow vulnerability
tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to attacker-controlled input?
Systems running tcpflow that capture network traffic can be exposed if an attacker can inject crafted IPv4 or IPv6 TCP packets into that traffic. Systems that process pcap files are also exposed when those files may contain attacker-controlled packets.
What access does an attacker need?
The attacker does not need authentication or local privileges. They need to introduce TCP packets with forged IP payload lengths into traffic tcpflow captures, or provide a pcap containing such packets.