CVE-2026-123205

    Dashboard / Vulnerabilities / CVE-2026-123205

    CVE-2026-123205

    Published: 5 Nov 2026Last Modified: 7 Nov 2026

    Summary: accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql

    Details: accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123205.json, https://github.com/accel-ppp/accel-ppp/releases/tag/1.15.0, https://nvd.nist.gov/vuln/detail/CVE-2026-123205, https://www.vulncheck.com/advisories/accel-ppp-before-1.15.0-heap-based-buffer-overflow-via-oversized-log-lines-in-log-tcp-log-syslog-log-pgsql, https://github.com/accel-ppp/accel-ppp/commit/58e399400c4ef4b71472ab7c2c71c54a677a05a8, https://github.com/accel-ppp/accel-ppp/pull/374, https://github.com/accel-ppp/accel-ppp, https://github.com/accel-ppp/accel-ppp/blob/048d31cb446879e0d1a1471b4ab99135a92bf289/accel-pppd/logs/log_tcp.c#L55-L67

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d80cdc61e82f7beb578f6c8232644f508ec95bb5

    Affected versions

    1.14.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-123205 | CVE-DB