CVE-2026-10069 Shibby Tomato miniupnpd resource consumption
Remote attackers can cause resource consumption in Shibby Tomato miniupnpd, leading to denial of service on unsupported firmware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-10069?
CVE-2026-10069 is a high-severity denial of service vulnerability in Shibby Tomato, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been found in Shibby Tomato 1.28. The impacted element is an unknown function of the file usr/sbin/miniupnpd. Such manipulation leads to resource consumption. The attack may be launched remotely. This project is superseded by FreshTomato. This vulnerability only affects products that are no longer supported by the maintainer.
Which versions are affected by CVE-2026-10069?
How do I fix CVE-2026-10069?
No fix has been published for CVE-2026-10069 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-10069 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-10069 exists.
Sources
Also known as GHSA-55h4-63gw-7vcm.