CVE-2026-17251
A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7.
Published Aug 21, 2026 · updated Oct 14, 2026
A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery.
Timeline
Detection, updates, and resolution for this record.
Aug 21, 2026 · NIST NVD
Detected
A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of mana
Oct 14, 2026 · NIST NVD
Updated
A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of mana
Sources
- CVE.orgCVE-2026-17251
Official CVE identifier
cve.org - FIRST EPSSCVE-2026-17251
30-day exploitation probability 0.5%
first.org - NIST NVDCVE-2026-17251
A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful
nvd.nist.gov