Read the docs
TI-2026-85584 Aliases CVE-2026-123205GHSA-4h7v-68mq-mxfg

Heap buffer overflow in accel-ppp logging lets remote peers crash it

Priority LOW 36CWE-122Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

accel-ppp before 1.15.0 contains a heap buffer overflow in its tcp, syslog and pgsql log targets. Log lines longer than LOG_MAX_SIZE overflow fixed heap buffers (CWE-122). An unauthenticated remote peer in the client-ip-range can corrupt heap memory and crash the daemon when verbose logging is enabled.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-range can send an L2TP Start-Control-Connection-Request with many string AVPs when verbose logging is enabled to corrupt heap memory and crash the daemon.

Why it matters now

EPSS 0.00417 36th percentileScored 2026-11-07
Fix Fixed accel-ppp (accel-ppp): 1.15.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
https://accel-ppp.org/accel-pppbefore 1.15.01.15.0Patch availableCNA

Remediation

Upgrade accel-ppp to version 1.15.0, which fixes this flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA accel-ppp (accel-ppp) Fixed in 1.15.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-11-05 Threatist record created from CVE-2026-123205
  2. 2026-11-05 Alias added: GHSA-4h7v-68mq-mxfg
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat
  5. 2026-11-07 Priority changed: MEDIUM → LOW

References

Patch 2

Other 2

  • TI-2020-17131 Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS… CVSS 3.1CRITICAL 9.8
  • TI-2022-00881 Buffer Overflow via crafted client request in Accel-PPP v1.12 CVSS 3.1CRITICAL 9.8
  • TI-2022-08520 Buffer Overflow via Crafted Ipv6 Prefix Attribute Type Client Request in accel-ppp v1.12 CVSS 3.1CRITICAL 9.8
  • TI-2022-08519 Buffer Overflow via Crafted IPv6 Addr Attribute Type Client Request in Accel-PPP v1.12 CVSS 3.1CRITICAL 9.8
  • TI-2020-11945 Heap buffer overflow in ACCEL-PPP CVSS 3.1CRITICAL 9.8
  • TI-2021-19024 ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request. CVSS 3.1HIGH 7.5
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences