CWE-406

CVEs classified under CWE-406, newest first.

5 CVEsRSS

CVE-2026-106465High· 8.7

The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns

The NetX Secure DTLS server sends a HelloVerifyRequest carrying a freshly generated cookie, but never checks the cookie a client returns. The ClientHello parser copies the client's cookie bytes over the value the server issued, and the s…

▾ TwilightEclipse Foundation · NetX DuoEPSS 0.31%via NVD

GHSA-6w6g-hm98-mhgmHigh

3w ago

hickory-resolver: Unbounded TC-retry loop in `NameServerPool::try_send` (resource-exhaustion DoS)

▾ Twilighthickory-resolver · hickory-resolvervia OSV

CVE-2026-16515Medium· 4.7

1mo ago

net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 error)

net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 error). It did not check whether the triggering packet's source addr…

▾ Sunlitzephyrproject · zephyrEPSS 0.25%via NVD

CVE-2026-86202Medium· 4.3

1mo ago

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players

PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigger consuming animations for all visible players. Attackers can send crafted ActorEventPacket mess…

▾ Sunlitpmmp · PocketMine-MPEPSS 0.35%via NVD

CVE-2026-54609High· 8.6

3mo ago

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

▾ Twilightquietterminal · com.quietterminal:qti-neonEPSS 0.46%via GHSA