SB2026090294 - Multiple vulnerabilities in scapy

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026090294

SB2026090294 - Multiple vulnerabilities in scapy

Published: September 2, 2026 Updated: September 9, 2026

Security Bulletin ID SB2026090294
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 11
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 36% Low 64%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 11 vulnerabilities.


1) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 5.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to loop with unreachable exit condition in the ISOTPSoftSocket receive scheduler when handling a rejected ISO-TP consecutive frame. A remote user can send a specially crafted CAN frame sequence to cause a denial of service.

User interaction is required to open and use an affected ISOTPSoftSocket, and the condition can persist after the crafted frames are consumed without continued traffic.


2) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to insufficient verification of data authenticity in receive_session_setup_response() when processing the final SMB SessionSetup response. A remote attacker can alter the guest-session flag in the response to disclose sensitive information.

Exploitation requires an active relay and a server that permits optional signing.


3) Improper Verification of Cryptographic Signature (CVE-ID: N/A)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose client application data.

The vulnerability exists due to improper verification of cryptographic signatures in TLSCertificateVerify.post_dissection() and TLSClientAutomaton when processing a TLS 1.3 server CertificateVerify message. A remote attacker can present a certificate with an invalid CertificateVerify signature to disclose client application data.

The TLS client continues the handshake and sends caller-supplied data despite the failed server-authentication proof.


4) Resource exhaustion (CVE-ID: N/A)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled resource consumption in the TFTP_RRQ_server read-server automaton when handling a TFTP read request without a matching acknowledgement. A remote attacker can send a TFTP read request for an available file and withhold the matching acknowledgement to cause a denial of service.

The affected server instance handles one transfer at a time and remains occupied while retransmitting the same data block every three seconds.


5) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a loop with an unreachable exit condition in the snmpwalk() function when processing an SNMP endOfMibView response. A remote attacker can respond with a legal terminal SNMP response to cause a denial of service.


6) Authentication Bypass by Capture-replay (CVE-ID: N/A)

CWE-ID: CWE-294 - Authentication Bypass by Capture-replay

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to repeat high-integrity server-side file operations.

The vulnerability exists due to authentication bypass by capture-replay in the Scapy SMB server when processing a captured authenticated SMB request. A remote attacker can replay a captured authenticated request to repeat high-integrity server-side file operations.


7) Use of insufficiently random values (CVE-ID: N/A)

CWE-ID: CWE-330 - Use of Insufficiently Random Values

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of insufficiently random values in the EncryptedPreMasterSecret class when establishing a TLS 1.2 connection using an RSA cipher suite. A remote attacker can observe the TLS handshake and traffic to disclose sensitive information.

The issue is limited to the RSA key-exchange path; TLS 1.3 and ephemeral Diffie-Hellman cipher suites do not use the affected class.


8) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper handling of additional PEM objects in the Cert class when processing a combined certificate and private-key PEM file configured for a TLS server. A local user can cause the server to include the private key in its TLS Certificate message to disclose sensitive information.

The disclosure is limited to additional valid PEM objects in the configured certificate file.


9) Cleartext transmission of sensitive information (CVE-ID: N/A)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to improper connection reuse in HTTP_Client when sending an HTTPS request after an HTTP request to the same host and explicitly selected port. A remote attacker can observe the reused plaintext connection to disclose sensitive information.

The HTTPS request is sent without TLS encryption when the earlier plaintext socket is reused.


10) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to impersonate a victim to another service and issue authenticated requests.

The vulnerability exists due to insufficient verification of data authenticity in the SPNEGOSSP authentication negotiation handling when processing a bare authentication token after SPNEGO mechanism negotiation has begun. A remote attacker can relay challenge-response messages and switch the authentication method from Kerberos to NTLM to impersonate a victim to another service and issue authenticated requests.

The attack requires inducing the victim's HTTP authentication and relaying several challenge-response messages.


11) Insufficient verification of data authenticity (CVE-ID: N/A)

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

CVSSv4: 5.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to obtain a user's new password.

The vulnerability exists due to insufficient verification of data authenticity in the KerberosClient TGS reply handling and kpasswd() helper when replaying a valid Kerberos TGS reply during a password-change request. A remote privileged user can substitute a previously captured reply for the current password-change response to obtain a user's new password.

User interaction is required to initiate the password change.


Remediation

Install update from vendor's website.

References