CVE-2020-24341

2020-12-1123:15:14

Google

osv.dev

picotcp-ng

tcp input data

out-of-bounds

denial-of-service

information leak

AI Score

6.5

Confidence

High

EPSS

0.002

Percentile

59.5%

JSON

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the length of incoming TCP packets, which leads to an out-of-bounds read when assembling received packets into a data segment, eventually causing Denial-of-Service or an information leak.