CVE-2026-120596

HIGH 7.5

CVE-2026-120596

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, developed by Ethernut/Egnite. Nut/OS releases up to version 5.1 are affected. An unauthenticated attacker can send a single TCP segment containing an unknown TCP option with a length byte of zero to any open TCP port on a vulnerable device. When processed, this malformed option triggers an infinite loop in the function NutTcpInputOptions, permanently blocking the TCP processing thread and rendering all TCP-based services unresponsive until the device is rebooted.

Vendor	ethernut / egnite gmbh
Product	nut/net tcp/ip stack
Published	Nov 2, 2026
Last Updated	Nov 2, 2026

Stay Ahead of the Next One

Get instant alerts for ethernut / egnite gmbh nut/net tcp/ip stack

Be the first to know when new high vulnerabilities affecting ethernut / egnite gmbh nut/net tcp/ip stack are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Ethernut / egnite GmbH / Nut/Net TCP/IP Stack

Nut/OS 5.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

ethernut.de: https://www.ethernut.de/en/download/index.html