CVE-2026-115449 Red Hat CVE debrief

Who should care

System administrators and security teams using Red Hat Enterprise Linux, OpenShift Container Platform, and other affected products should assess exposure and verify remediation for libslirp in affected systems, considering the potential for host IP leaks in user-mode networking setups. They should also review compensating controls for exposed systems while remediation is scheduled and verified, and check relevant monitoring, detection, and logs for exposed

Why it matters

CVE-2026-115449 is a libslirp vulnerability that may leak host IP addresses to guests in specific networking configurations. System administrators and security teams should assess exposure, verify vendor remediation, and perform inventory checks.

• Potential host IP leak in user-mode networking
• Verification of vendor remediation required
• Inventory checks for affected systems necessary

Technical summary

The libslirp library has a flaw in handling ICMP echo requests, causing a length mismatch that can leak the host's IP address to the guest in user-mode networking environments. This issue affects various Red Hat products, including Red Hat Enterprise Linux and OpenShift Container Platform. The vulnerability has a CVSS score of 3.5 and is considered low severity. The issue can be mitigated by verifying vendor remediation for libslirp in affected systems and assessing exposure in user-mode networking setups. System administrators and security teams should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Defensive priority

Assess exposure in user-mode networking setups, verify vendor remediation for libslirp in affected systems.

Recommended defensive actions

• Assess exposure in user-mode networking setups
• Verify vendor remediation for libslirp in affected systems
• Inventory and check systems using libslirp
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the libslirp vulnerability. Red Hat has a security advisory for this issue. The vulnerability affects various Red Hat products, including Red Hat Enterprise Linux and OpenShift Container Platform. The issue is caused by a flaw in handling ICMP echo requests, leading to a length mismatch that can leak the host's IP address to the guest in user-mode networking environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.