# CVE-2026-10686: Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Status: published. Published: 2026-07-31. Updated: 2026-11-04.

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet() (subsys/net/ip) were affected: the explicit-route path (net_route_packet()) and the on-link cross-interface path (net_route_packet_if()). Each set the packet forwarding flag and called net_send_data() with the hop limit untouched and no expiry check.

Per RFC 8200 the hop-limit decrement is the mechanism that bounds packet lifetime and terminates routing loops; without it, a device acting as an IPv6 router relays looping packets indefinitely. An on-path attacker who can induce or exploit a transient L3 loop turns it into a permanent forwarding storm, causing CPU/bandwidth resource exhaustion (availability DoS) on the forwarder and adjacent links; path-discovery and loop diagnostics that rely on hop-limit expiry are also defeated.

Affected configurations. In every affected release the forwarding path is reached via CONFIG_NET_ROUTE (enabled by default when CONFIG_NET_IPV6_NBR_CACHE is set), together with CONFIG_NET_ROUTING for cross-interface routing. Note that CONFIG_NET_IPV6_FORWARDING and CONFIG_NET_IPV4_FORWARDING — which appear in the fix and in this advisory's evidence notes — were introduced after v4.4.0, when the routing options were split and renamed; they do not exist in any affected release. When auditing a v4.4.1-or-earlier configuration, look for CONFIG_NET_ROUTE and CONFIG_NET_ROUTING.

IPv4 is not affected in any release. The IPv4 forwarding path (net_route_ipv4_packet() in route_ipv4.c) was added after v4.4.0 and has never shipped in a release. Its TTL decrement and IPv4 header-checksum recomputation landed on main as part of the same fix, so the evidence notes below discuss it, but no released version is reachable by way of IPv4.

Affected releases are v1.8.0 through v4.4.1: v1.8.0 introduced net_route_packet() and v2.2.0 added net_route_packet_if(), and neither decremented the hop limit. v4.3.1 carries the explicit-route fix but not the on-link one, so it is affected as well. Fixed on main by 7d8f1afa7345 (explicit-route path) and 589eadc74efa (on-link path).

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: zephyr) — https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: zephyr) — https://github.com/zephyrproject-rtos/zephyr/commit/589eadc74efaaade104d27497027006c9a1ba013
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: vulnerabilities@zephyrproject.org) — https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: vulnerabilities@zephyrproject.org) — https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4cg6-6jc4-2r6h

## Affected products and versions

- zephyrproject / zephyr (zephyr): ≥ 1.8.0; < 4.5.0 (affected, semver). Source: CNA: zephyr

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:zephyrproject:zephyr:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "4.5.0",
            "versionStartIncluding": "1.8.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 5.8 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L; source: CNA: zephyr

- CVSS 3.1: 7.5 (high); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: NVD: nvd@nist.gov

- CVSS 3.1: 5.8 (medium); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L; source: NVD: vulnerabilities@zephyrproject.org

- CISA KEV: No listing in collected sources

- EPSS: 0.52% as of 2026-11-03; percentile 43.95%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-835

## Exploit evidence

- exploit: https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4cg6-6jc4-2r6h (vulnerabilities@zephyrproject.org)

## References

- https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a (CNA: zephyr; patch)

- https://github.com/zephyrproject-rtos/zephyr/commit/589eadc74efaaade104d27497027006c9a1ba013 (CNA: zephyr; patch)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4cg6-6jc4-2r6h (CNA: zephyr)

- https://github.com/zephyrproject-rtos/zephyr/commit/589eadc74efaaade104d27497027006c9a1ba013 (vulnerabilities@zephyrproject.org)

- https://github.com/zephyrproject-rtos/zephyr/commit/7d8f1afa7345975b58405d6fba18bb8c3f7cb12a (vulnerabilities@zephyrproject.org; Patch)

- https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-4cg6-6jc4-2r6h (vulnerabilities@zephyrproject.org; Exploit, Patch, Vendor Advisory)

## Provenance

- CNA: zephyr: https://www.cve.org/CVERecord?id=CVE-2026-10686; retrieved 2026-11-04; source updated 2026-11-04

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-10686; retrieved 2026-11-04; source updated 2026-11-04

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-10686; retrieved 2026-11-04; source updated Not reported

Revision: 986a2e4ae552d1921622e964ba018dbc3983fd92eda3d2a5cf7fce70c2ff835b

Canonical: https://y2.dev/cve/CVE-2026-10686

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.