CVE-2026-123205 accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123205?
CVE-2026-123205 is a high-severity vulnerability in accel-ppp, published on 5 Nov 2026.
Official description
accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.
Weakness: CWE-122
Which versions are affected by CVE-2026-123205?
How do I fix CVE-2026-123205?
No fix has been published for CVE-2026-123205 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-123205 being exploited?
There is no known exploitation of CVE-2026-123205 in the wild and no public exploit code.
Sources
Also known as GHSA-4h7v-68mq-mxfg.