Heap Buffer Overflow Vulnerability in Accel-PPP Product by Accel-PPP
CVE-2026-123205

8.3HIGH

Key Information:

Vendor

Accel-ppp

Status
Accel-ppp
Vendor
CVE Published:
5 November 2026

What is CVE-2026-123205?

Accel-PPP versions before 1.15.0 are affected by a heap buffer overflow in the tcp, syslog, and pgsql log targets. This vulnerability allows unauthenticated remote attackers to exploit fixed heap buffers through overly long log entries, particularly when verbose logging is enabled. Attackers within the client IP range can send manipulated L2TP Start-Control-Connection-Request messages containing excess string Attribute Value Pairs (AVPs), ultimately leading to heap memory corruption and potential crashes of the daemon. Immediate upgrading to version 1.15.0 or later is strongly recommended to mitigate risks.

Affected Version(s)

accel-ppp 0 < 1.15.0

References

https://github.com/accel-ppp/accel-ppp/pull/374
issue-trackingpatch
https://github.com/accel-ppp/accel-ppp/commit/58e399400c4...
patch
https://github.com/accel-ppp/accel-ppp/releases/tag/1.15.0
release-notes

CVSS V4

Score:
8.3
Severity:
HIGH
Confidentiality:
None
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Deus Rex
Denys Fedoryshchenko (nuclearcat)
.