CVE-2026-56099

Name of the Vulnerable Software and Affected Versions OpenBSD versions prior to commit 6a23123

Description An out-of-bounds read exists in the mpls do error() function within sys/netmpls/mpls input.c. Remote attackers can disclose kernel stack memory by sending crafted MPLS frames containing 16 labels without the Bottom-of-Stack bit set. This trigger causes the system to leak 4 bytes of adjacent kernel stack memory back to the attacker within an ICMP/MPLS error response.

Recommendations Update to the version containing commit 6a23123 or later. As a temporary workaround, disable MPLS to minimize the risk of exploitation.