# CVE-2026-16515: Denial of service in zephyr > An attacker can cause network amplification and denial of service by sending crafted ICMPv6 packets to Zephyr nodes, degrading link availability. - **Severity:** Medium 4.7 (`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Local or same network only - **Victim action needed:** Not needed - **Fix available:** No - **Published:** 18 Sep 2026 - **Updated:** 18 Sep 2026 - **Also known as:** GHSA-v5vw-m78m-h46g ## What is CVE-2026-16515? CVE-2026-16515 is a medium-severity denial of service vulnerability in zephyrproject zephyr, published on 18 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim. ### Official description net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an ICMPv6 error with an ICMPv6 error). It did not check whether the triggering packet's source address identifies a single node (rule e.6) or whether the packet was sent to a multicast destination (rule e.3, whose only exceptions are Packet Too Big and Parameter Problem Code 2). Of the five call sites, only the port-unreachable path in subsys/net/ip/connection.c carried an equivalent guard of its own; the extension-header, unknown-next-header and fragmentation paths in subsys/net/ip/ipv6.c and subsys/net/ip/ipv6_fragment.c had none. An unauthenticated attacker with access to the same link can exploit this in two ways. Sending a single IPv6 packet to the link-local all-nodes group ff02::1 carrying an unrecognized next-header value, with the source address spoofed to a chosen victim, causes every Zephyr node on the link to emit an ICMPv6 Parameter Problem message to that victim — a reflector with an amplification factor equal to the number of nodes. Alternatively, sending a unicast packet whose source address is a multicast address causes the node to transmit its ICMPv6 error to that multicast address, turning one unicast packet into a link-flooded multicast frame. Packets addressed to ff02::1 are accepted unconditionally by ipv6_input(), and no check rejects a multicast source address, so no special configuration is required. The impact is degraded availability of the shared link and of the reflection victim, together with the ability for the attacker to hide its own address behind the responding nodes. The effect is amplified on constrained mesh links such as 802.15.4/Thread, where link-local multicast is flooded hop by hop. There is no memory-safety consequence: the error packet itself is well formed, it is simply emitted in cases where the protocol forbids it. The fix adds both suppression checks at the single choke point in net_icmpv6_send_error(), before any reply packet is allocated, preserving the RFC-mandated exceptions for NET_ICMPV6_PACKET_TOO_BIG and Parameter Problem Code 2. Note that the IPv4 counterpart net_icmpv4_send_error() in subsys/net/ip/icmpv4.c still checks only for a broadcast destination and retains an equivalent gap for multicast destinations and non-unique sources. Weakness: CWE-406 (Insufficient Control of Network Message Volume (Network Amplification)) ## Which versions are affected by CVE-2026-16515? ## How do I fix CVE-2026-16515? No fix has been published for CVE-2026-16515 yet. Limit exposure of the affected software until one is available. ## Is CVE-2026-16515 being exploited? There is no known exploitation of CVE-2026-16515 in the wild and no public exploit code. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-16515 and fix it if it is affected. What it is: CVE-2026-16515 is a medium-severity denial of service vulnerability in zephyrproject zephyr, published on 18 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-16515 in the wild and no public exploit code. Affected product: zephyrproject zephyr. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-16515/ (Markdown: https://insights.sbomify.com/CVE-2026-16515/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-16515 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-16515 - OSV: https://osv.dev/vulnerability/CVE-2026-16515 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-16515/ Summaries are generated and may contain mistakes; the official description above is the record.