Threats tagged 'ghsa-9h8r-54hw-6fp8'

P-Net versions before 1.0.4 have a vulnerability where RPC sessions allocated for request fragments with unknown activity UUIDs are kept indefinitely without timeout if the rest of the request never arrives. Sessions without an Application Relationship are also retained after the response. This behavior allows an unauthenticated attacker with adjacent network access to exhaust available sessions by sending repeated fragments or requests with different activity UUIDs, causing a denial of service as the device stops responding to Connect requests until restarted.