Is CVE-2026-15813 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15813 being exploited in the wild.

How severe is CVE-2026-15813?

Medium severity, with a CVSS score of 6.5, published 20 July 2026.

Is there a fix for CVE-2026-15813?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15813 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15813?

Check whether you run Kronosnet, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15813: kronosnet heap corruption in packet de-fragmentation engine

CVE-2026-15813 · Severity: medium · CVSS 6.5 · Published 2026-07-20

Kronosnet is a network protocol used to create secure communication channels between servers, often used in high-availability clusters. A flaw in how it handles fragmented data packets allows a remote attacker to send specially crafted traffic that can crash the service or cause system instability. This could lead to a denial-of-service condition, disrupting the reliability of server clusters and potentially impacting data availability.

Technologies: Kronosnet, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4. Vendors: Kronosnet, Red Hat.

Quick answers

Is CVE-2026-15813 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15813 being exploited in the wild.
How severe is CVE-2026-15813?: Medium severity, with a CVSS score of 6.5, published 20 July 2026.
Which products and versions are affected?: Kronosnet <= 1.34.
Is there a fix for CVE-2026-15813?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15813 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15813?: Check whether you run Kronosnet, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the core network packet de-fragmentation engine of kronosnet (version 1.34 and earlier). The internal reassembly code fails to properly validate sequence numbers and offsets of incoming payload fragments. By transmitting malformed packets with overlapping or invalid sequence parameters, a network-based attacker can trigger an out-of-bounds write (CWE-787) or heap corruption. This occurs when the parser attempts to reassemble the payload using deceptive offsets, writing data beyond the allocated buffer limits. Successful exploitation can lead to a daemon crash (DoS) or potentially arbitrary code execution.

Affected products

kronosnet kronosnet <= 1.34
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat OpenShift Container Platform 4

Timeline

2026-07-15: disclosed: Initial report in Red Hat Bugzilla
2026-07-20: advisory: CVE published by NVD and Red Hat

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.