{"id":"CVE-2026-102552","summary":"Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver","details":"Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.\n\n\n\nTo remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.","aliases":["GHSA-h4fw-pv82-p7h5"],"modified":"2026-10-17T02:47:51.395878157Z","published":"2026-10-16T17:28:47.578Z","database_specific":{"cna_assigner":"AMZN","cwe_ids":["CWE-940"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102552.json"},"references":[{"type":"ADVISORY","url":"https://aws.amazon.com/security/security-bulletins/2026-139-aws/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102552.json"},{"type":"FIX","url":"https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2"},{"type":"ADVISORY","url":"https://github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-h4fw-pv82-p7h5"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102552"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/freertos/freertos-plus-tcp","events":[{"introduced":"0"},{"last_affected":"c12361095aca68aeed858f45d14395fbffa92c0d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"4.4.1"}],"source":"AFFECTED_FIELD"}}],"versions":["V4.4.1","V4.4.0","V4.0.0-appsec","V2.4.0","V2.3.4","V2.3.2","V2.3.3","V2.3.1","V2.3.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102552.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}