PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-10686 zephyrproject CVE debrief

Zephyr's IPv6 forwarding path re-sent routed unicast packets without decrementing the IPv6 hop limit, allowing an on-path attacker to induce a permanent forwarding storm, causing CPU/bandwidth resource exhaustion on the forwarder and adjacent links. This vulnerability was introduced in v1.8.0 and affected releases up to v4.4.1. The issue was fixed on main by 7d8f1afa7345 and 589eadc74efa. Users of Zephyr with IPv6 forwarding enabled should review and apply patches, verify configurations, and monitor for unusual network activity.

Vendor
zephyrproject
Product
zephyr
CVSS
MEDIUM 5.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-31
Original CVE updated
2026-08-07
Advisory published
2026-07-31
Advisory updated
2026-08-07

Who should care

Users of Zephyr with IPv6 forwarding enabled, network administrators, security teams, and operators of affected systems should review and apply patches, verify configurations, and monitor for unusual network activity. This vulnerability can cause CPU/bandwidth resource exhaustion on the forwarder and adjacent links, leading to availability DoS.

Technical summary

The IPv6 forwarding path in Zephyr did not decrement the hop limit, allowing packets to loop indefinitely. This can be exploited by an on-path attacker to cause a permanent forwarding storm, leading to CPU/bandwidth resource exhaustion on the forwarder and adjacent links. The issue was introduced in v1.8.0 and affected releases up to v4.4.1. Fixed on main by 7d8f1afa7345 and 589eadc74efa. Affected configurations include those with CONFIG_NET_ROUTE and CONFIG_NET_ROUTING enabled. IPv4 is not affected.

Defensive priority

Medium priority due to potential for availability DoS

Recommended defensive actions

  • Review and apply patches for affected Zephyr versions
  • Verify configuration for IPv6 forwarding
  • Monitor for unusual network activity
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The IPv6 forwarding path in Zephyr did not decrement the hop limit, allowing packets to loop indefinitely. Fixed on main by 7d8f1afa7345 and 589eadc74efa. The issue was introduced in v1.8.0 and affected releases up to v4.4.1. Users should verify their configurations and apply patches. Evidence is limited, and defenders should review the CVE record and NVD details for further information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-10686 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-10686

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-10686 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-10686

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.