CRITICAL🇵🇱 Wersja polska

CVE-2024-38373

CVSS 9.6v3.1pub. 2024-06-24upd. 2024-11-21

FreeRTOS-Plus-TCP is a lightweight TCP/IP stack for FreeRTOS. FreeRTOS-Plus-TCP versions 4.0.0 through 4.1.0 contain a buffer over-read issue in the DNS Response Parser when parsing domain names in a DNS response. A carefully crafted DNS response with domain name length value greater than the actual domain name length, could cause the parser to read beyond the DNS response buffer. This issue affects applications using DNS functionality of the FreeRTOS-Plus-TCP stack. Applications that do not use DNS functionality are not affected, even when the DNS functionality is enabled. This vulnerability has been patched in version 4.1.1.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H

  • Amazon Freertos Plus Tcp

    APP
    Amazon
    4.0.0 – 4.1.1 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2026-7422HIGH7.1ten sam produkt

Insufficient packet validation in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor ...

CVE-2026-7424HIGH7.2ten sam produkt

Integer underflow in the DHCPv6 sub-option parser in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adja...

CVE-2026-7426MEDIUM6.1ten sam produkt

Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TC...

CVE-2026-7423MEDIUM6.0ten sam produkt

Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 all...

CVE-2026-7425MEDIUM6.0ten sam produkt

Insufficient option length validation in the IPv6 Router Advertisement parser in FreeRTOS-Plus-TCP before V4.2...