High 8.6Published Apr 3, 2026

CVE-2026-23457netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()

Updated under an hour ago (Oct 27, 2026, 5:50 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() sip_help_tcp() parses the SIP Content-Length header with simple_strtoul(), which returns unsigned long, but stores the result in unsigned int clen. On 64-bit systems, values exceeding UINT_MAX are silently truncated before computing the SIP message boundary. For example, Content-Length 4294967328 (2^32 + 32) is truncated to 32, causing the parser to miscalculate where the current message ends. The loop then treats trailing data in the TCP segment as a second SIP message and processes it through the SDP parser. Fix this by changing clen to unsigned long to match the return type of simple_strtoul(), and reject Content-Length values that exceed the remaining TCP payload length.

CVSS: 8.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Weakness (CWE): CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before ed81b6a7012485acdb9c6c80735a0b7d8e5e1873; from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f; from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before b75209debb9adab287b3caa982f77788c1e15027; from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before 528b4509c9dfc272e2e92d811915e5211650d383; from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before 75fcaee5170e7dbbee778927134ef2e9568b4659; from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before 865dba58958c3a86786f89a501971ab0e3ec6ba9; from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before d4f17256544cc37f6534a14a27a9dec3540c2015; from f5b321bd37fbec9188feb1f721ab46a5ac0b35da before fbce58e719a17aa215c724473fd5baaa4a8dc57c	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.34 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.78; from 6.13 before 6.18.20; from 6.19 before 6.19.10; 7.0; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/ed81b6a7012485acdb9c6c80735a0b7d8e5e1873	patch
https://git.kernel.org/stable/c/cd1b7403ec835f8a0b3f1f7e68ac26af2cb1e42f	patch
https://git.kernel.org/stable/c/b75209debb9adab287b3caa982f77788c1e15027	patch
https://git.kernel.org/stable/c/528b4509c9dfc272e2e92d811915e5211650d383	patch
https://git.kernel.org/stable/c/75fcaee5170e7dbbee778927134ef2e9568b4659	patch
https://git.kernel.org/stable/c/865dba58958c3a86786f89a501971ab0e3ec6ba9	patch
https://git.kernel.org/stable/c/d4f17256544cc37f6534a14a27a9dec3540c2015	patch
https://git.kernel.org/stable/c/fbce58e719a17aa215c724473fd5baaa4a8dc57c	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.