{"id":"CVE-2026-46433","aliases":["ALPINE-CVE-2026-46433","AZL-89700","CLSA-2026-1781628379","CLSA-2026-1782221091","DEBIAN-CVE-2026-46433","EUVD-2026-35858","GHSA-2g8p-2h3j-63m3","UBUNTU-CVE-2026-46433","openSUSE-SU-2026:10794-1","openSUSE-SU-2026:21146-1"],"status":"published","title":"lldpd: Heap OOB Read in VLAN Decapsulation memmove","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00225,"percentile":0.13302,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-05-16T00:00:00Z","modified":"2026-11-03T06:33:03Z","fixes":[{"ecosystem":"Alpine:v3.23","package":"lldpd","fixed_in":["1.0.22-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"lldpd","fixed_in":["1.0.22-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"lldpd","fixed_in":["1.0.22-1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"lldpd","fixed_in":["1.0.4-10.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"lldpd-devel","fixed_in":["1.0.4-10.el9.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"lldpd","fixed_in":["1.0.18-6.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"lldpd-devel","fixed_in":["1.0.18-6.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lldpd","fixed_in":["1.0.22-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lldpd","fixed_in":["1.0.22-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"lldpd","fixed_in":["1.0.22-bp160.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-10.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"lldpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-10.el9.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-6.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"lldpd-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.18-6.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.16-1","1.0.16-1+deb12u1","1.0.17-1","1.0.18-1","1.0.19-1","1.0.21-1","1.0.22-1"]},{"source":"osv","ecosystem":"Debian:13","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.18-1","1.0.19-1","1.0.21-1","1.0.22-1"]},{"source":"osv","ecosystem":"Debian:14","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-1"}]}],"versions":["1.0.18-1","1.0.19-1","1.0.21-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-0ubuntu4","2.4.0-0ubuntu5","2.5.0~git20160129.46a88d9-0ubuntu1","2.5.0~git20160219.522aca6-0ubuntu1","2.5.0~git20160219.522aca6-0ubuntu2","2.5.0~git20160219.522aca6-0ubuntu3","2.5.0-0ubuntu1","2.5.2-0ubuntu0.16.04.1","2.5.2-0ubuntu0.16.04.2","2.5.2-0ubuntu0.16.04.3","2.5.4-0ubuntu0.16.04.1","2.5.5-0ubuntu0.16.04.1","2.5.5-0ubuntu0.16.04.2","2.5.9-0ubuntu0.16.04.2","2.5.9-0ubuntu0.16.04.3","2.5.9-0ubuntu0.16.04.3+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.16-1","0.7.19-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.8.0-0ubuntu2","2.8.1-0ubuntu2","2.8.1-0ubuntu3","2.9.0~git20180205.5a39582ca-0ubuntu1","2.9.0-0ubuntu1","2.9.2-0ubuntu0.18.04.2","2.9.2-0ubuntu0.18.04.3","2.9.5-0ubuntu0.18.04.1","2.9.7-0ubuntu0.18.04.2","2.9.8-0ubuntu0.18.04.2","2.9.8-0ubuntu0.18.04.3","2.9.8-0ubuntu0.18.04.4","2.9.8-0ubuntu0.18.04.5","2.9.8-0ubuntu0.18.04.5+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.8-1","0.9.9-1","0.9.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.12.0-0ubuntu1","2.12.0-0ubuntu2","2.12.1~git20191107.7accd1302-0ubuntu1","2.12.90~git20200107.af683565b-0ubuntu1","2.12.90~git20200107.af683565b-0ubuntu2","2.12.90~git20200107.af683565b-0ubuntu3","2.13.0~git20200127.dbdf66c29-0ubuntu2","2.13.0~git20200212.15ae9db33-0ubuntu1","2.13.0~git20200212.15ae9db33-0ubuntu2","2.13.0-0ubuntu1","2.13.1-0ubuntu0.20.04.1","2.13.1-0ubuntu0.20.04.3","2.13.1-0ubuntu0.20.04.4","2.13.3-0ubuntu0.20.04.1","2.13.3-0ubuntu0.20.04.2","2.13.5-0ubuntu1","2.13.8-0ubuntu1","2.13.8-0ubuntu1.1","2.13.8-0ubuntu1.2","2.13.8-0ubuntu1.3","2.13.8-0ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.4-1","1.0.4-1build1","1.0.4-1build2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.11-1","1.0.12-1","1.0.13-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.16.0-0ubuntu2","2.16.0-0ubuntu3","2.16.0-0ubuntu4","2.17.0~git20220105.0d1ffb7-0ubuntu1","2.17.0~git20220118.1b9fd88-0ubuntu1","2.17.0~git20220121.109d024-0ubuntu1","2.17.0-0ubuntu1","2.17.2-0ubuntu0.22.04.1","2.17.2-0ubuntu0.22.04.2","2.17.3-0ubuntu0.22.04.1","2.17.3-0ubuntu0.22.04.2","2.17.5-0ubuntu0.22.04.2","2.17.7-0ubuntu0.22.04.1","2.17.8-0ubuntu0.22.04.1","2.17.9-0ubuntu0.22.04.1","2.17.9-0ubuntu0.22.04.2","2.17.12-0ubuntu0.22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.17-1","1.0.18-1","1.0.18-1build1","1.0.18-1build3","1.0.18-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.2.0-1","3.2.0-2","3.2.0-2build1","3.2.2~git20231029-2","3.2.2~git20231029-2build1","3.3.0~git20240118.e802fe7-2","3.3.0~git20240118.e802fe7-3","3.3.0-1","3.3.0-1build1","3.3.0-1ubuntu1","3.3.0-1ubuntu3","3.3.0-1ubuntu3.1","3.3.0-1ubuntu3.2","3.3.4-0ubuntu0.24.04.1","3.3.4-0ubuntu0.24.04.2","3.3.9-0ubuntu0.24.04.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.18-1build3","1.0.18-1build4"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.0-1build1","3.5.1-0ubuntu1","3.6.0-1","3.6.0-2","3.6.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.19-1","1.0.22-1","1.0.22-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.7.1-2","3.7.1-3","3.7.1-3build1","4.0.0-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.18-1build4","1.0.19-1","1.0.19-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"openvswitch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.0-2","3.6.0-2build1","3.6.0-5","3.6.0-6","3.6.0-6build1","3.6.0-6ubuntu2","3.7.0~git20260211.8c6ebf8-1~1.gbp9127d1","3.7.0-1","3.7.0-1build1","3.7.1-1","3.7.1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"lldpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.22-bp160.1.1"}]}]}],"products":[{"vendor":"lldpd","product":"lldpd"},{"vendor":"lldpd_project","product":"lldpd"},{"vendor":"microsoft","product":"lldpd"}],"references":[{"url":"https://github.com/lldpd/lldpd/security/advisories/GHSA-2g8p-2h3j-63m3","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/lldpd/lldpd/pull/787","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","report"]},{"url":"https://github.com/lldpd/lldpd/commit/ca931be63a9cae0fcd8e9b6ae4e916d49f141cd6","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/lldpd/lldpd/releases/tag/1.0.22","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-46433","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46433","tags":["web","advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1781628379.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782221091.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46433.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-46433","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-46433","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46433","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46433","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2026-46433","title":"lldpd: Heap OOB Read in VLAN Decapsulation memmove","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T22:49:02.749Z","modified":"2026-06-10T18:12:30.269Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-35858","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T22:49:02Z","modified":"2026-06-10T18:12:30Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:44.937217Z"}],"nvd":[{"id":"CVE-2026-46433","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T23:16:59.437Z","modified":"2026-07-23T09:10:00.113Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"ALPINE-CVE-2026-46433","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T23:16:59.437Z","modified":"2026-11-03T06:33:03.213100111Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-46433","title":"lldpd: Heap OOB Read in VLAN Decapsulation memmove","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T22:49:02.749Z","modified":"2026-10-28T10:55:22.956466259Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:05.870292Z"},{"id":"DEBIAN-CVE-2026-46433","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T23:16:59.437Z","modified":"2026-10-01T03:03:16.122268449Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:56.025495Z"},{"id":"UBUNTU-CVE-2026-46433","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T23:16:00Z","modified":"2026-10-21T10:16:13.943224328Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:30.797112Z"},{"id":"AZL-89700","title":"CVE-2026-46433 affecting package lldpd for versions less than 1.0.22-1","description":"lldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.","status":"published","published":"2026-06-09T23:16:59Z","modified":"2026-08-28T17:56:22.183994Z","updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"CLSA-2026-1781628379","title":"lldpd: Fix of CVE-2026-46433","description":"- CVE-2026-46433: fix heap out-of-bounds read in VLAN decapsulation memmove","status":"published","published":"2026-06-16T16:46:33Z","modified":"2026-10-26T09:30:20.69717794Z","updated_at":"2026-11-02T15:43:45.445699Z"},{"id":"CLSA-2026-1782221091","title":"lldpd: Fix of CVE-2026-46433","description":"- CVE-2026-46433: fix heap out-of-bounds read in lldpd_decode when stripping VLAN tag","status":"published","published":"2026-06-23T13:25:06Z","modified":"2026-10-26T09:31:11.322573208Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"openSUSE-SU-2026:10794-1","title":"liblldpctl4-1.0.22-1.1 on GA media","description":"These are all security issues fixed in the liblldpctl4-1.0.22-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-16T00:00:00Z","modified":"2026-05-17T14:18:08.451662Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"openSUSE-SU-2026:21146-1","title":"Security update for lldpd","description":"This update for lldpd fixes the following issues:\n\nChanges in lldpd:\n\n- Update to version 1.0.22\n  * Fix CVE-2026-46433, out-of-bound read access when removing\n    VLAN tag (#787).\n  * Reject 0-length management address in LLDP.\n  * Fix race condition when creating the control socket.\n  * Fix FDP MAC address.\n  * Fix memory leak in the BSD bridge query path.\n  * Fix duplicate management addresses when merging EDP VLAN\n    frames.\n\n- Update to version 1.0.21\n  Changes:\n  * Add \"configure lldp portdescription-source\" to choose how to\n    populate port description.\n  Fix:\n  * Fix path traversal vulnerabilities in the privileged process.\n  * Fix arbitrary file deletion in the privileged process.\n  * Fix accuracy of Dot3 MAU types advertised and add support for\n    200G and 400G.\n  * Fix detection of wireless interfaces.\n\n- Update to version 1.0.20\n  Changes:\n  * Enable fast start unconditionally (and move its configuration\n    in \"configure lldp\").\n  * Make VLAN advertisements configurable.\n  Fix:\n  * Do not break zero-copy traffic on Linux.\n  * Fix crash on rapid addition/removal of interfaces.\n  * Fix management address selection when pattern is a negative\n    IP address.\n\n- Update to version 1.0.19\n  Changes:\n  * Add cvlan/svlan/tpmr capabilities.\n  * Add lldpctl_watch_sync_unblock to liblldpctl.\n  * Add C++ wrapper for lldpctl.\n  Fix:\n  * Fix AppArmor policy for /run/lldpd/lldpd.socket.lock.\n  * Do not query stats for a down interface on Linux.\n","status":"published","published":"2026-06-22T13:05:26Z","modified":"2026-06-30T18:24:45.576327368Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}