CVE-2026-56099: OpenBSD MPLS Stack Memory Disclosure Vulnerability

Technical summary

The vulnerability exists in the mpls_do_error function (sys/netmpls/mpls_input.c) and is triggered when the kernel processes MPLS frames containing 16 labels without a Bottom-of-Stack (BoS) bit set. This condition causes the function to read beyond allocated buffer boundaries, exposing kernel stack memory to a remote attacker. The flaw is classified as CWE-125 (Out-of-bounds Read) and requires no privilege escalation or complex network conditions—any unauthenticated network-adjacent attacker can craft the malicious packet.

Business impact

The primary risk is information leakage from kernel memory, which may contain sensitive data such as encryption keys, memory addresses (defeating ASLR), or other secrets used in active sessions. While this does not directly compromise the system, leaked kernel addresses or cryptographic material could enable follow-on attacks or help an attacker bypass security mechanisms. Organizations running OpenBSD routers or MPLS-enabled network devices should prioritize patching to prevent reconnaissance and credential harvesting.

Affected systems

OpenBSD systems with MPLS functionality enabled are affected. This primarily impacts OpenBSD installations used as network equipment (routers, switches) or systems explicitly configured to process MPLS traffic. Systems without MPLS in active use may have lower exposure but are still vulnerable if the stack is compiled in. Verify your OpenBSD deployment's network configuration and kernel compilation options to determine applicability.

Exploitability

Exploitability is straightforward from a network perspective: an attacker needs only to send crafted MPLS frames over the network. No authentication, local access, or user interaction is required. The attack is passive and can be repeated to exfiltrate larger amounts of kernel memory. However, the attacker must have network reachability to the target system and must understand the MPLS protocol structure, which limits the pool of opportunistic attackers—this is not a trivial drive-by vulnerability.

Remediation

Upgrade to OpenBSD with commit 6a23123 or later (2026-06-18 or newer). The fix adds proper bounds checking in the mpls_do_error function to prevent out-of-bounds reads when processing MPLS frames. If upgrading is not immediately possible, consider disabling MPLS at the network edge or restricting MPLS traffic using firewall rules to systems where it is actually required.

Patch guidance

Apply the patch corresponding to OpenBSD commit 6a23123 (dated 2026-06-18) or later. Consult OpenBSD's official security advisories and release notes to verify the correct patch level for your branch. Test the patch in a staging environment first, as MPLS configuration can be intricate. After patching, restart any network services that depend on MPLS packet processing.

Detection guidance

Monitor for unusual MPLS traffic patterns, particularly frames with 16 labels and anomalous BoS bit configurations. Network intrusion detection systems (IDS) may flag malformed MPLS packets if rules are in place. Enable kernel audit logging if available to track access patterns to mpls_input.c code paths. Check system logs for any kernel errors or faults coinciding with suspicious MPLS traffic.

Why prioritize this

While the CVSS score of 5.3 (Medium) reflects the limited scope of impact (information disclosure only), the ease of exploitation and the sensitive nature of kernel memory contents warrant moderately high priority. Organizations with MPLS-enabled infrastructure should treat this as a near-term patch candidate, particularly if the systems are exposed to untrusted networks or handle cryptographic operations.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a remote, low-complexity attack with no privilege requirements (AV:N, AC:L, PR:N, UI:N) but limited impact—confidentiality is compromised (C:L) while integrity and availability remain intact (I:N, A:N). The score appropriately captures a meaningful but contained risk; information leakage from kernel memory is serious in context but does not result in immediate system takeover or service disruption.

Frequently asked questions