CVE-2026-8836: Lwip Snmp Asn1 Dec Raw Aliased Length And Bufmax
Call to snmp_asn1_dec_raw passes the same expression as both the read-length (2nd argument) and the destination buffer maximum length (5th argument). snmp_asn1_dec_raw's internal bounds check is `if (len > buf_max_len) return ERR_MEM;` so identical arguments make the guard a no-op, allowing an attacker-controlled ASN.1 OCTET STRING length (e.g. msgAuthentica
Cgreprules fetch cve-2026-8836-lwip-snmp-asn1-dec-raw-aliased-length-and-bufmax --engine opengrepDescription
Call to snmp_asn1_dec_raw passes the same expression as both the read-length (2nd argument) and the destination buffer maximum length (5th argument). snmp_asn1_dec_raw's internal bounds check is `if (len > buf_max_len) return ERR_MEM;` so identical arguments make the guard a no-op, allowing an attacker-controlled ASN.1 OCTET STRING length (e.g. msgAuthentica
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.