CVE-2026-112200 Details
Description
P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session when an RPC request is rejected because its data representation has incorrect endianness. The session and its AR remain allocated, so repeated requests exhaust the available sessions. Once they are exhausted the device no longer answers new RPC requests, including Connect, until it is restarted. A remote unauthenticated attacker can use this to cause a denial of service.
A resource exhaustion vulnerability has been identified in P-Net versions prior to 1.0.3. The issue arises when an RPC request is rejected due to incorrect endianness; the Application Relationship (AR) and the RPC session are not released. This oversight allows repeated requests to exhaust available RPC sessions. Once all sessions are used up, the device stops responding to new RPC requests, including connection requests, until it is restarted. This vulnerability can be exploited by a remote, unauthenticated attacker to cause a denial-of-service condition.
Users are advised to upgrade to P-Net version 1.0.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://rt-labs.com/wp-content/uploads/2026/10/RRTL-261019-01.pdf | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-772 | Missing Release of Resource after Effective Lifetime | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |
Affected Products
| Product | Versions |
|---|---|
| RT-Labs P-Net | < 1.0.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | New CVE Received | 4b71179a-3b92-4a9d-b9fc-af8b8ed579ee |