IETF vulnerabilities
We track 3 vulnerabilities in IETF products across 3 products. 3 are rated high or critical, and 1 has been exploited in real attacks. The most recent was published on July 9, 2024.
Latest IETF vulnerabilities
- 9.0 Critical severity
RFC: Improper Validation of Integrity Check Value
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authent
- 7.6 High severity
DHCP: Missing Authentication for Critical Functionality
DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network c
- 7.5 High severity
HTTP/2 Rapid Reset Attack Exploited
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.