{"id":"CVE-2026-34119","state":"PUBLISHED","title":"Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS","description":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive.","publishedAt":"2026-04-02T17:19:50.931Z","updatedAt":"2026-04-03T13:06:40.136Z","severity":{"score":7.1,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","source":"TPLink"},"assigner":"TPLink","products":["TP-Link Systems Inc. Tapo C520WS v2.6"],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C520WS v2.6","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.2.4 Build 260326 Rel.24666n","versionType":"custom"}],"modules":["HTTP Parsing Loop"]}],"references":["https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","https://www.tp-link.com/us/support/faq/5047/"],"weaknesses":["CWE-122"],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/34xxx/CVE-2026-34119.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-34119","state":"PUBLISHED","datePublished":"2026-04-02T17:19:50.931Z","dateUpdated":"2026-04-03T13:06:40.136Z","assignerShortName":"TPLink","assignerOrgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateReserved":"2026-03-25T18:54:03.343Z"},"containers":{"cna":{"title":"Heap-based Buffer Overflow Vulnerability Leading to Denial-of-Service in TP-Link Tapo C520WS","descriptions":[{"lang":"en","value":"A heap-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP parsing\nloop\nwhen appending segmented request bodies without\ncontinuous write‑boundary verification, due to insufficient boundary validation when handling externally supplied HTTP input.  An attacker\non the same network segment could trigger heap memory corruption conditions by\nsending crafted payloads that cause write operations beyond allocated buffer\nboundaries.  Successful exploitation\ncauses a Denial-of-Service (DoS) condition, causing the device’s process to\ncrash or become unresponsive."}],"affected":[{"vendor":"TP-Link Systems Inc.","product":"Tapo C520WS v2.6","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"1.2.4 Build 260326 Rel.24666n","versionType":"custom"}],"modules":["HTTP Parsing Loop"]}],"references":[{"url":"https://www.tp-link.com/us/support/download/tapo-c520ws/#Firmware-Release-Notes","tags":["patch"]},{"url":"https://www.tp-link.com/en/support/download/tapo-c520ws/#Firmware-Release-Notes","tags":["patch"]},{"url":"https://www.tp-link.com/us/support/faq/5047/","tags":["vendor-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"HIGH","baseScore":7.1,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-122","lang":"en","description":"CWE-122 Heap-based buffer overflow","type":"CWE"}]}],"providerMetadata":{"shortName":"TPLink","orgId":"f23511db-6c3e-4e32-a477-6aa17d310630","dateUpdated":"2026-04-02T17:19:50.931Z"},"impacts":[{"capecId":"CAPEC-100","descriptions":[{"lang":"en","value":"CAPEC-100 Overflow Buffers"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.1"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-04-03T13:06:32.399642Z","id":"CVE-2026-34119","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-04-03T13:06:40.136Z"}}]}}}