{
    "document": {
        "category": "csaf_security_advisory",
        "csaf_version": "2.0",
        "title": "Kestrel Embedded KNet TCP/IP stack: out-of-bounds write in IPv6 fragment reassembly",
        "publisher": {
            "category": "coordinator",
            "name": "Medical Device Security Exchange (demo stand-in)",
            "namespace": "https://mdsx.sergeant.com/"
        },
        "tracking": {
            "id": "MDSX-2026-0142",
            "status": "final",
            "version": "1",
            "initial_release_date": "2026-11-03T03:29:15Z",
            "current_release_date": "2026-11-03T03:29:15Z",
            "revision_history": [
                {
                    "date": "2026-11-03T03:29:15Z",
                    "number": "1",
                    "summary": "Initial publication"
                }
            ]
        },
        "notes": [
            {
                "category": "summary",
                "title": "Summary",
                "text": "A crafted sequence of IPv6 fragments can cause an out-of-bounds write in the KNet TCP/IP stack versions 2.4.0 through 2.4.2. A remote, unauthenticated attacker on the same network segment could crash the device or, under some memory layouts, corrupt adjacent state. Devices that do not enable IPv6 are not affected."
            }
        ],
        "distribution": {
            "tlp": {
                "label": "WHITE"
            }
        }
    },
    "product_tree": {
        "branches": [
            {
                "category": "vendor",
                "name": "Kestrel Embedded",
                "branches": [
                    {
                        "category": "product_name",
                        "name": "KNet TCP/IP stack",
                        "branches": [
                            {
                                "category": "product_version_range",
                                "name": ">=2.4.0|<=2.4.2",
                                "product": {
                                    "name": "Kestrel Embedded KNet TCP/IP stack 2.4.0 to 2.4.2",
                                    "product_id": "CSAFPID-0001"
                                }
                            }
                        ]
                    }
                ]
            }
        ]
    },
    "vulnerabilities": [
        {
            "title": "Kestrel Embedded KNet TCP/IP stack: out-of-bounds write in IPv6 fragment reassembly",
            "notes": [
                {
                    "category": "description",
                    "text": "A crafted sequence of IPv6 fragments can cause an out-of-bounds write in the KNet TCP/IP stack versions 2.4.0 through 2.4.2. A remote, unauthenticated attacker on the same network segment could crash the device or, under some memory layouts, corrupt adjacent state. Devices that do not enable IPv6 are not affected."
                }
            ],
            "product_status": {
                "known_affected": [
                    "CSAFPID-0001"
                ]
            },
            "scores": [
                {
                    "products": [
                        "CSAFPID-0001"
                    ],
                    "cvss_v3": {
                        "version": "3.1",
                        "baseScore": 8.6,
                        "baseSeverity": "HIGH",
                        "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"
                    }
                }
            ],
            "remediations": [
                {
                    "category": "vendor_fix",
                    "details": "Update to KNet 2.4.3 or later. Until then, disable IPv6 on the affected interface or block IPv6 fragments at the network boundary of the device segment.",
                    "product_ids": [
                        "CSAFPID-0001"
                    ]
                }
            ]
        }
    ],
    "x_nexaform_join": {
        "component": "KNet TCP/IP stack",
        "versionFrom": "2.4.0",
        "versionTo": "2.4.2"
    }
}