Threats affecting pkg:github/sonic3air

CVE-2026-66733 is a high-severity vulnerability in Eukaryot sonic3air versions up to 26.03.28.0. It involves an unbounded memory allocation in the ReceivedPacketCache::enqueuePacket() function triggered by a crafted UDP packet with a maximum uint32 mUniquePacketID. This causes excessive memory allocation leading to server process crash due to uncaught exceptions.

CVE-2026-66732 is a vulnerability in Eukaryot sonic3air versions up to 26.03.28.0 where the ConnectionManager fails to validate the source address of incoming UDP datagrams. This allows an on-path attacker who can observe cleartext UDP traffic to inject forged packets into established sessions by spoofing the two-byte connection handle. The attacker can terminate sessions, forge channel messages, and send forged request responses without needing IP address spoofing.