CVE-2026-51599 Denial of service in n/a
An unauthenticated remote attacker can cause a temporary denial of service on MERCURY IP cameras by sending malformed RTSP requests that hang TCP connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-51599?
CVE-2026-51599 is a critical denial of service vulnerability in n/a, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An insufficient input validation vulnerability in the RTSP service of MERCURY MIPC252W v1.0.5 Build 230306 Rel.79931n allows an unauthenticated remote attacker to render an individual TCP connection temporarily unusable via sending an RTSP request with a Content-Length header but no corresponding message body. The affected RTSP parser enters a body-waiting state instead of rejecting the malformed request, causing all subsequent data on the connection to be silently consumed as body content until a server-side timeout closes the connection.
Weakness: CWE-20
Which versions are affected by CVE-2026-51599?
How do I fix CVE-2026-51599?
No fix has been published for CVE-2026-51599 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-51599 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-51599 exists.
Sources
Also known as GHSA-c38f-3577-frmw.