Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-119600— tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length

Quick assessment

Affected
simsong tcpflow
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

tcpflow 1.6.1 及之前版本存在越界读取漏洞。未认证的攻击者可通过发送伪造 IP 载荷长度的数据包，读取进程内存。攻击者可将精心构造的 IPv4 或 IPv6 TCP 数据包注入到捕获的流量或 pcap 文件中，从而导致相邻内存泄露到重建的流文件中，或造成 tcpflow 崩溃。

CVSS 4.8 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
simsong tcpflow ≤ 1.6.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-119600

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tcpflow through 1.6.1 Out-of-Bounds Read via TCP Demultiplexer Payload Length
Source: CVE Program / CVE List V5
Vulnerability Description
tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending packets with forged IP payload lengths. Attackers can inject crafted IPv4 or IPv6 TCP packets into captured traffic or pcap files to leak adjacent memory into reconstructed flow files or crash tcpflow.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
长度参数不一致性处理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
simsong tcpflow 0 ~ 1.6.1 -

II. Public POCs for CVE-2026-119600

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-119600

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-119600 (1)

Security Blog Posts for CVE-2026-119600 (1)

Vendor Pages for CVE-2026-119600 (1)

Other References for CVE-2026-119600 (1)

IV. Related Vulnerabilities

Same product: tcpflow
Same vendor: simsong
Same weakness: CWE-130