CVE-2026-115449

Name	CVE-2026-115449
Description	A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libslirp (PTS)	bookworm	4.7.0-1	vulnerable
	trixie	4.8.0-1+deb13u1	vulnerable
	forky, sid	4.9.5-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
libslirp	source	(unstable)	(unfixed)

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2558916
https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/105
Fixed by: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/262c9be27bc79e16b369807b460be77e23c3d788