Page MenuHomeVyOS Platform
Create Task
Maniphest T8860

OpenNHRP: OOB Read/Write via invalid NHRP Extension Type
Closed, ResolvedPublic
Actions

Description

nhrp_packet_extension() in nhrp_packet.c:290-316 indexes two fixed-size 10-element arrays with extension & 0x7fff (range 0-32767) with no bounds check.
Triggered during unmarshall_packet() before authentication, causes crash or infinite CPU loop.

Details

Version
-
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Security vulnerability

Event Timeline

RC created this task.May 13 2026, 6:51 PM
RC changed the task status from Open to In progress.
RC triaged this task as High priority.
RC created this object in space S1 VyOS Public.
RC created this object with visibility "Administrators".
Viacheslav closed this task as Resolved.Mon, Oct 5, 3:01 PM
Viacheslav changed the visibility from "Administrators" to "Public (No Login Required)".
Viacheslav moved this task from Need Triage to Completed on the VyOS Rolling board.