CVE-2026-14461

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-14461
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14461.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-14461
Downstream
Published
2026-07-10T10:38:28.947Z
Modified
2026-07-21T23:32:07.065442Z
Severity
  • 5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Out-of-bound read in mtr
Details

mtr is vulnerable to Out-of-bound read vulnerability in ipinfolookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME field. ipinfolookup() function uses the length of the response as the end-of-message boundary for dn_expand() function. The result is a reliable crash.

This issue exists in the mtr through version 0.96 and it was fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3.

Database specific 
{
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/14xxx/CVE-2026-14461.json",
    "cna_assigner": "CERT-PL"
}
References

Affected packages

Git / github.com/traviscross/mtr

Affected ranges

Type
GIT
Repo
https://github.com/traviscross/mtr
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f392168771570b0fdc104c38dea6bbc2ce585710
Fixed
48e1794414d338ce47abc0f27c25ade8788af9c3
Database specific 
{
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.96"
        }
    ]
}

Affected versions

v0.*
v0.21
v0.22
v0.23
v0.24
v0.25
v0.26
v0.27
v0.28
v0.29
v0.30
v0.31
v0.32
v0.33
v0.34
v0.35
v0.36
v0.37
v0.38
v0.39
v0.40
v0.41
v0.42
v0.43
v0.44
v0.45
v0.46
v0.47
v0.48
v0.49
v0.50
v0.51
v0.52
v0.53
v0.54
v0.55
v0.56
v0.57
v0.58
v0.59
v0.60
v0.61
v0.62
v0.63
v0.64
v0.65
v0.66
v0.67
v0.68
v0.69
v0.70
v0.71
v0.72
v0.73
v0.74
v0.75
v0.76
v0.77
v0.78
v0.79
v0.80
v0.81
v0.82
v0.83
v0.84
v0.85
v0.86
v0.87
v0.89
v0.90
v0.91
v0.92
v0.93
v0.94
v0.95
v0.96

Database specific

vanir_signatures_modified 
"2026-07-21T23:32:07Z"
vanir_signatures 
[
    {
        "signature_type": "Function",
        "target": {
            "file": "ui/asn.c",
            "function": "ipinfo_lookup"
        },
        "deprecated": false,
        "source": "https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3",
        "id": "CVE-2026-14461-45a2db1e",
        "signature_version": "v1",
        "digest": {
            "function_hash": "58086218141098156513177467916593493793",
            "length": 2591.0
        }
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "ui/asn.c"
        },
        "deprecated": false,
        "source": "https://github.com/traviscross/mtr/commit/48e1794414d338ce47abc0f27c25ade8788af9c3",
        "id": "CVE-2026-14461-65182c50",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "34684605763752025811968906011777834154",
                "276165693037927514176709724730147042257",
                "65657812927491120029595831262421187682",
                "144022469932787083289584101726924352840"
            ],
            "threshold": 0.9
        }
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-14461.json"