{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-10686 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-10686 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-10686 is a medium-severity denial of service vulnerability in Zephyrproject Zephyr, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-10686 and fix it if it is affected.\n\nWhat it is: CVE-2026-10686 is a medium-severity denial of service vulnerability in Zephyrproject Zephyr, published on 31 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-10686 in the wild and no public exploit code.\n\nAffected product: Zephyrproject Zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-10686/ (Markdown: https://insights.sbomify.com/CVE-2026-10686/index.md)","id":"CVE-2026-10686","markdown":"https://insights.sbomify.com/CVE-2026-10686/index.md","name":"CVE-2026-10686","record":{"aliases":["GHSA-4cg6-6jc4-2r6h"],"analysis":{"component_type":"operating_system","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Zephyr RTOS","requires_auth":"none","summary":"Attackers can cause permanent packet forwarding loops and resource exhaustion in Zephyr IPv6 routers due to missing hop-limit decrements.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"zephyr","cpe":[{"product":"zephyr","vendor":"zephyrproject"}],"cvss":{"score":5.8,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","version":"3.1"},"cwes":[{"id":"CWE-835","name":"Loop with Unreachable Exit Condition"}],"description":"Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet() (subsys/net/ip) were affected: the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()). Each set the packet forwarding flag and called net_send_data() with the hop limit untouched and no expiry check.\n\nPer RFC 8200 the hop-limit decrement is the mechanism that bounds packet lifetime and terminates routing loops; without it, a device acting as an IPv6 router relays looping packets indefinitely. An on-path attacker who can induce or exploit a transient L3 loop turns it into a permanent forwarding storm, causing CPU/bandwidth resource exhaustion (availability DoS) on the forwarder and adjacent links; path-discovery and loop diagnostics that rely on hop-limit expiry are also defeated.\n\nAffected configurations. In every affected release the forwarding path is reached via CONFIG_NET_ROUTE (enabled by default when CONFIG_NET_IPV6_NBR_CACHE is set), together with CONFIG_NET_ROUTING for cross-interface routing. Note that CONFIG_NET_IPV6_FORWARDING and CONFIG_NET_IPV4_FORWARDING — which appear in the fix and in this advisory's evidence notes — were introduced after v4.4.0, when the routing options were split and renamed; they do not exist in any affected release. When auditing a v4.4.1-or-earlier configuration, look for CONFIG_NET_ROUTE and CONFIG_NET_ROUTING.\n\nIPv4 is not affected in any release. The IPv4 forwarding path (net_route_ipv4_packet() in route_ipv4.c) was added after v4.4.0 and has never shipped in a release. Its TTL decrement and IPv4 header-checksum recomputation landed on main as part of the same fix, so the evidence notes below discuss it, but no released version is reachable by way of IPv4.\n\nAffected releases are v1.8.0 through v4.4.1: v1.8.0 introduced net_route_packet() and v2.2.0 added net_route_packet_if(), and neither decremented the hop limit. v4.3.1 carries the explicit-route fix but not the on-link one, so it is affected as well. Fixed on main by 7d8f1afa7345 (explicit-route path) and 589eadc74efa (on-link path).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers","id":"CVE-2026-10686","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"zephyrproject:zephyr","products":["zephyrproject:zephyr"],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"This CVE Record has been rejected by the Zephyr Project CNA.","id":"CVE-2026-10687"},"packages":[],"prev":{"headline":"Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler","id":"CVE-2026-10685"},"products":["zephyr"],"published":"2026-07-31","related":[{"cvss_score":9.8,"headline":"Out-of-bounds read/write in HTTP WebSocket upgrade via non-null-terminated Sec-WebSocket-Key","id":"CVE-2026-5067","kev_date_added":null,"published":"2026-06-09"},{"cvss_score":9.8,"headline":"Bluetooth HCI Error Handling Double Free","id":"CVE-2022-3806","kev_date_added":null,"published":"2023-01-19"},{"cvss_score":9.8,"headline":"Memory corruption in getaddrinfo","id":"CVE-2017-14199","kev_date_added":null,"published":"2019-04-12"},{"cvss_score":9.8,"headline":"Null dereference in n/a","id":"CVE-2018-1000800","kev_date_added":null,"published":"2018-09-06"},{"cvss_score":9.6,"headline":"DOS: Incorrect handling of the initial HCI ACL_MTU handshake packet leads to crash of bluetooth host layer","id":"CVE-2021-3329","kev_date_added":null,"published":"2023-02-26"},{"cvss_score":9.6,"headline":"DoS: Invalid Initialization in le_read_buffer_size_complete","id":"CVE-2023-0397","kev_date_added":null,"published":"2023-01-19"},{"cvss_score":9.6,"headline":"Usb bluetooth device ACL read cb buffer overflow","id":"CVE-2021-3966","kev_date_added":null,"published":"2023-01-11"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["zephyrproject"]},"summary":"Attackers can cause permanent packet forwarding loops and resource exhaustion in Zephyr IPv6 routers due to missing hop-limit decrements.","url":"https://insights.sbomify.com/CVE-2026-10686/"}