Improper Input Validation in MidnightBSD Package Manager
CVE-2026-54579

2.3LOW

Key Information:

Vendor

Midnightbsd

Status
Mport
Vendor
CVE Published:
17 September 2026

What is CVE-2026-54579?

The MidnightBSD Package Manager (mport) prior to version 2.7.8 has a vulnerability where the ping() function does not adequately validate ICMP replies. Attackers can inject or spoof ICMP replies, affecting mirror latency selection. Additionally, malformed packets with altered IP options may misalign the ICMP header, leading to potential out-of-bounds read scenarios. This issue poses significant risks to network integrity and user data, making it crucial for users to upgrade to version 2.7.8 or later to ensure protection.

Affected Version(s)

mport < 2.7.8

References

https://github.com/MidnightBSD/mport/security/advisories/...
x_refsource_CONFIRM

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.