CVE-2026-56101

    Dashboard / Vulnerabilities / CVE-2026-56101

    CVE-2026-56101

    Published: 8 Sept 2026Last Modified: 17 Sept 2026

    Summary: OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

    Details: OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/56xxx/CVE-2026-56101.json, https://nvd.nist.gov/vuln/detail/CVE-2026-56101, https://www.vulncheck.com/advisories/openbsd-ieee80211-crypto-tkip-c-tkip-mic-countermeasure-logic-inversion-dos, https://github.com/openbsd/src/commit/1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a, https://github.com/openbsd/src, https://pop.argus-systems.ai/advisory/adv-209.html

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-56101 | CVE-DB