CVE-2026-102552 is a medium severity vulnerability in Amazon FreeRTOS-Plus-TCP versions up to 4.4.1. It involves improper verification of the source of a communication channel in the DNS resolver, which could allow a remote attacker to insert a forged DNS reply into the device's DNS cache. The issue is fixed in version 4.4.2 by enabling ipconfigDNS_CHECK_REPLY_SOURCE_IP.
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement.
To remediate this issue, users should upgrade to version V4.4.2.
Insufficient validation of the prefix length field in IPv6 Router Advertisement processing in FreeRTOS-Plus-TCP before V4.2.6 and V4.4.1 allows an adjacent network actor to cause memory corruption by sending a crafted Router Advertisement with a prefix length value exceeding the maximum valid length, resulting in a heap buffer overflow. Users processing IPv4 RA only are not impacted.
To mitigate this issue, users should upgrade to the fixed version when available.
CVE-2026-7425 is an out-of-bounds read vulnerability in the IPv6 Router Advertisement parser of AWS FreeRTOS-Plus-TCP before versions 4.2.6 and 4.4.1. It occurs due to insufficient validation of option length in the PREFIX_INFORMATION option, which can be truncated smaller than expected. An adjacent network actor can exploit this flaw to cause a denial of service by crashing the device. The issue is fixed in versions 4.2.6 and 4.4.1.
CVE-2026-7424 is an integer underflow vulnerability in the DHCPv6 sub-option parser of AWS FreeRTOS-Plus-TCP versions before 4.2.6 and 4.4.1. This flaw allows an adjacent network actor to corrupt IPv6 address assignment, DNS configuration, and lease times, and can cause a denial of service by freezing the IP task, requiring a hardware reset. The issue affects devices with DHCPv6 enabled. AWS has released fixed versions 4.2.6 and 4.4.1 to address this vulnerability.
Integer underflow in the ICMP and ICMPv6 echo reply handlers in FreeRTOS-Plus-TCP before V4.4.1 and V4.2.6 allows an adjacent network user to cause a denial of service (device crash) when outgoing ping support is enabled, because header sizes are subtracted from a packet length field without validating the field is large enough, resulting in a heap out-of-bounds read of up to approximately 65KB.
To mitigate this issue, users should upgrade to the fixed version when available.
CVE-2026-7422 is an authentication bypass vulnerability in AWS FreeRTOS-Plus-TCP affecting versions before 4.2.6 and 4.4.1. The flaw allows an adjacent network attacker to bypass checksum and minimum-size packet validation by spoofing the Ethernet source MAC address to match a device's own registered endpoint. This occurs because the loopback detection mechanism skips input validation for packets with a source MAC matching a local endpoint. The vulnerability has a medium severity with a CVSS score of 6.5. Fixed versions 4.2.6 and 4.4.1 are available to mitigate the issue.
We have identified a buffer overflow issue allowing out-of-bounds write when processing LLMNR or mDNS queries with very long DNS names. This issue only affects systems using Buffer Allocation Scheme 1 with LLMNR or mDNS enabled.
Users should upgrade to the latest version and ensure any forked or derivative code is patched to incorporate the new fixes.