# CVE-2026-56099: OpenBSD kernel stack memory disclosure in mpls_do_error

Source: https://junglewise.ai/threats/cve-2026-56099-openbsd-kernel-stack-memory-disclosure-in-mpls-do-error  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-18. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56099 · Severity: medium · CVSS 5.3 · Published 2026-06-18

A vulnerability in the OpenBSD operating system's networking code could allow a remote attacker to view sensitive information from the system's memory. By sending specially crafted network packets (MPLS frames), an attacker can trigger an error response that inadvertently includes small pieces of internal kernel data. This could potentially be used to bypass security protections or gain insights into the system's internal operations.

Vendors: [OpenBSD](https://junglewise.ai/threats/vendors/openbsd).

## Quick answers

**Is CVE-2026-56099 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56099 being exploited in the wild.

**How severe is CVE-2026-56099?** Medium severity, with a CVSS score of 5.3, published 18 June 2026.

**Which products and versions are affected?** OpenBSD-current prior to 2026-06-18 (commit 6a23123).

**Is there a fix for CVE-2026-56099?** A patch was published on 2026-06-18: Fix committed to OpenBSD source tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56099 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-56099?** Check whether you run OpenBSD-current at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An out-of-bounds read vulnerability exists in sys/netmpls/mpls_input.c within the mpls_do_error function. The function parses an incoming MPLS label stack into a fixed 16-entry local array. If a packet contains 16 labels without a Bottom-of-Stack (BoS) bit set, the loop counter reaches 16. Subsequent code uses an incorrect length calculation of (nstk + 1), resulting in a 17th entry being read from the 16-entry array. This 4-byte over-read of kernel stack memory is then included in the ICMP/MPLS error response sent back to the attacker. The vulnerability is reachable remotely if MPLS is enabled on an interface and can be exploited repeatedly to harvest kernel memory.

## Affected products

- OpenBSD OpenBSD-current prior to 2026-06-18 (commit 6a23123)

## Timeline

- 2026-06-12: disclosed: Reported to OpenBSD by Argus Systems
- 2026-06-18: patched: Fix committed to OpenBSD source tree
- 2026-06-18: advisory

## References

- [https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd](https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd)
- [https://pop.argus-systems.ai/advisory/adv-040.html](https://pop.argus-systems.ai/advisory/adv-040.html)
- [https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-input](https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-input)
- [http://seclists.org/fulldisclosure/2026/Jun/17](http://seclists.org/fulldisclosure/2026/Jun/17)
- [http://www.openwall.com/lists/oss-security/2026/06/19/3](http://www.openwall.com/lists/oss-security/2026/06/19/3)