UBUNTU-CVE-2026-115449

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-115449

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115449.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-115449

Upstream

CVE-2026-115449

Published

2026-10-22T22:18:00Z

Modified

2026-10-28T17:50:38Z

Severity

3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.

References

Affected packages

Ubuntu:20.04:LTS / libslirp

Package

Name: libslirp
Purl: pkg:deb/ubuntu/libslirp?arch=source&distro=focal

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.0.0-1

4.0.0-2

4.1.0-1

4.1.0-2

4.1.0-2ubuntu1

4.1.0-2ubuntu2

4.1.0-2ubuntu2.1

4.1.0-2ubuntu2.2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libslirp0",
            "binary_version": "4.1.0-2ubuntu2.2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115449.json"

Ubuntu:22.04:LTS / libslirp

Package

Name: libslirp
Purl: pkg:deb/ubuntu/libslirp?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.4.0-1build1

4.6.1-1

4.6.1-1build1

4.6.1-1ubuntu0.2

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libslirp0",
            "binary_version": "4.6.1-1ubuntu0.2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115449.json"

Ubuntu:24.04:LTS / libslirp

Package

Name: libslirp
Purl: pkg:deb/ubuntu/libslirp?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.7.0-1ubuntu1

4.7.0-1ubuntu2

4.7.0-1ubuntu3

4.7.0-1ubuntu3.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libslirp0",
            "binary_version": "4.7.0-1ubuntu3.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115449.json"

Ubuntu:26.10 / libslirp

Package

Name: libslirp
Purl: pkg:deb/ubuntu/libslirp?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.9.1-1ubuntu1

4.9.3-1ubuntu1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libslirp0",
            "binary_version": "4.9.3-1ubuntu1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115449.json"

Ubuntu:26.04:LTS / libslirp

Package

Name: libslirp
Purl: pkg:deb/ubuntu/libslirp?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

4.*

4.8.0-1ubuntu1

4.9.1-1ubuntu1

4.9.1-1ubuntu1.1

Ecosystem specific

{
    "binaries": [
        {
            "binary_name": "libslirp0",
            "binary_version": "4.9.1-1ubuntu1.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-115449.json"