- Description
- In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an invalid sequence number. Specifically, after a SYN packet is observed, an RST with an invalid SEQ can transition the conntrack entry to TCP_CONNTRACK_CLOSE, regardless of whether the RST corresponds to the expected reply direction. The relevant code path assumes the RST is a response to an outgoing SYN, but does not validate packet direction or ensure that a matching SYN was actually sent in the opposite direction. As a result, a crafted packet sequence consisting of a SYN followed by an invalid-sequence RST can prematurely terminate an active NAT entry. This makes connection teardown easier than intended. So, tighten the state transition logic to ensure that RST-triggered CLOSE transitions only occur when the RST is a valid response to a previously observed SYN in the correct direction.
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 8.2
- Impact score
- 4.2
- Exploitability score
- 3.9
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- Severity
- HIGH
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CWE-20
- Hype score
- Not currently trending
Recent NatJack attacks exploit NAT for TCP hijack & DNS spoofing (CVE-2026-56181, CVE-2026-63913), compromising data privacy/integrity in transit. New Spacebar Server CVE allows cross-channel message deletion. #Cybersecurity #Geopolitics #News
@YourAnon_irc
11 Aug 2026
66 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
π― NatJack β new NAT manipulation attack hijacks TCP sessions & spoofs DNS Researcher Malcolm Stagg unveiled NatJack at Black Hat USA 2026. Affects Windows (CVE-2026-56181, CVSS 8.3) and Linux Netfilter (CVE-2026-63913, CVSS 8.2). Enables TCP hijacking, DNS spoofing, and
@XQOPTRX
10 Aug 2026
59 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
TRC analysis shows NatJack attacks exploit NAT vulnerabilities (CVE-2026-56181, CVE-2026-63913) to hijack active TCP sessions and spoof DNS responses. Attackers manipulate connection states to move laterally within networks behind the same NAT. Runtime segmentation helps limit
@aviatrixtrc
7 Aug 2026
90 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Security researcher Malcolm Stagg disclosed NatJack, an attack class that manipulates NAT state to hijack TCP sessions and spoof DNS responses. Windows NAT/Hyper-V (CVE-2026-56181, CVSS 8.3) and Linux Netfilter conntrack (CVE-2026-63913, CVSS 8.2) are both affected. Attackers
@XavierRiveraX
7 Aug 2026
105 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
Security research exposes NatJack attacks that hijack TCP sessions through NAT table manipulation. The flaws hit Windows NAT under CVE-2026-56181 and Linux Netfilter conntrack under CVE-2026-63913. An attacker behind the same NAT can hijack TCP sessions that legitimate users ht
@zubiqo
7 Aug 2026
96 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes