{"id":"CVE-2026-23457","revision":"e9fed06e10ce4b45a0041b0f9e9558bc","records":[{"revision":"e9fed06e10ce4b45a0041b0f9e9558bc","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23457","aliases":[],"title":"netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()\n\nsip_help_tcp() parses the SIP Content-Length header with\nsimple_strtoul(), which returns unsigned long, but stores the result in\nunsigned int clen.  On 64-bit systems, values exceeding UINT_MAX are\nsilently truncated before computing the SIP message boundary.\n\nFor example, Content-Length 4294967328 (2^32 + 32) is truncated to 32,\ncausing the parser to miscalculate where the current message ends.  The\nloop then treats trailing data in the TCP segment as a second SIP\nmessage and processes it through the SDP parser.\n\nFix this by changing clen to unsigned long to match the return type of\nsimple_strtoul(), and reject Content-Length values that exceed the\nremaining TCP payload length.","state":0,"publishedAt":"2026-04-03T15:15:38.193+00:00","modifiedAt":"2026-10-19T18:35:44.867+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nf_conntrack_sip.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"ed81b6a7012485acdb9c6c80735a0b7d8e5e1873\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"b75209debb9adab287b3caa982f77788c1e15027\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"528b4509c9dfc272e2e92d811915e5211650d383\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"75fcaee5170e7dbbee778927134ef2e9568b4659\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"865dba58958c3a86786f89a501971ab0e3ec6ba9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"d4f17256544cc37f6534a14a27a9dec3540c2015\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f5b321bd37fbec9188feb1f721ab46a5ac0b35da\",\n                            \"lessThan\": \"fbce58e719a17aa215c724473fd5baaa4a8dc57c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nf_conntrack_sip.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.34\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.34\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.167\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.130\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.78\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.20\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.10\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H","score":8.6,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873","https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f","https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027","https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383","https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659","https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9","https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015","https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23457","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23457","identifiers":["CVE-2026-23457"]},"retained":false,"historicalAffected":[]}],"coverage":[]}