CVE-2026-79900: boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the…

PriorityP335medium6.5CVSS 3.1

AVNACLPRLUINSUCNINAH

EPSS

0.24%

13.1th percentile

boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL recognizes the digest name but do not verify that the value fits in a fixed 16-byte checksum context field before copying it. An authenticated KSL client can supply an oversized, OpenSSL-recognized digest name and write beyond the end of the heap allocation.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
fortra	boks_manager_boks-server	< 8.1.0.24	8.1.0.24
fortra	boks_manager_boks-server	< 9.0.0.7	9.0.0.7

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.