CVE-2026-8369

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-8369

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8369.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-8369

Published

2026-05-13T13:36:09Z

Modified

2026-10-21T03:00:29Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

Improper Input Validation in OpenThread NAT64 Translator

Details

Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 network to inject corrupted IPv6 packets into the Thread mesh or bypass security checks via crafted IPv4 packets with options.

Database specific

{
    "cna_assigner":  "Google",
    "cwe_ids":  [
        "CWE-20"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8369.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "commit 26a882d"
                        },
                        {
                            "last_affected":  "commit 26a882d"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandaloneSingleVersion"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/openthread/openthread

Affected ranges

Type

GIT

Repo

https://github.com/openthread/openthread

Events

Introduced

Fixed

26a882d

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "26a882d"
                }
            ],
            "source":  "DESCRIPTION"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-8369.json"