Threats tagged 'ghsa-pcww-cvpx-6v39'

CVE-2026-66732 is a vulnerability in Eukaryot sonic3air versions up to 26.03.28.0 where the ConnectionManager fails to validate the source address of incoming UDP datagrams. This allows an on-path attacker who can observe cleartext UDP traffic to inject forged packets into established sessions by spoofing the two-byte connection handle. The attacker can terminate sessions, forge channel messages, and send forged request responses without needing IP address spoofing.