Linux Netfilter conntrack direction-validation flaw (CVE-2026-63913)
Vulnerability
Summary
Hide ▲
Show ▼
CVE-2026-63913 in Linux Netfilter conntrack lets a crafted SYN plus invalid reset packet prematurely close a NAT entry, creating session-state manipulation risk for affected systems. The flaw was fixed in stable Linux releases including 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. The issue was disclosed through the broader NatJack research and carries a CVSS score of 8.2.
Related Happenings
Isolated-vm ExternalCopy type confusion GHSA-864f-rcv7-6rh4 remote code execution flaw
Vulnerability
H score16
First: 20.08.2026 16:48
Last: 20.08.2026 16:48
Sources 1
About this happening:
isolated-vm users face a critical ExternalCopy type confusion flaw that can let sandboxed JavaScript escape into the host process and corrupt memory across all versi...
Isolated-vm ExternalCopy type confusion GHSA-864f-rcv7-6rh4 remote code execution flaw
VulnerabilityAbout this happening: isolated-vm users face a critical ExternalCopy type confusion flaw that can let sandboxed JavaScript escape into the host process and corrupt memory across all versi...
NatJack NAT-state attack research and proof-of-concept exploitation
Technical Analysis
H score21
First: 07.08.2026 12:32
Last: 07.08.2026 12:32
Sources 1
How related:
Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
About this happening:
NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increas...
NatJack NAT-state attack research and proof-of-concept exploitation
Technical AnalysisHow related: Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
About this happening: NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increas...
NatJack Windows and Linux NAT state-hijack flaws (multiple vulnerabilities)
Vulnerability
H score23
First: 07.08.2026 11:52
Last: 07.08.2026 11:52
Sources 1
How related:
Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack.
About this happening:
NatJack exposes Windows NAT used by Hyper-V and Linux Netfilter conntrack to session hijacking, DNS spoofing, and NAT-table exhaustion. Researchers assigne...
NatJack Windows and Linux NAT state-hijack flaws (multiple vulnerabilities)
VulnerabilityHow related: Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack.
About this happening: NatJack exposes Windows NAT used by Hyper-V and Linux Netfilter conntrack to session hijacking, DNS spoofing, and NAT-table exhaustion. Researchers assigne...
Timeline
-
07.08.2026 12:32 2 articles · 14d ago
Linux Netfilter conntrack flaw lets crafted packets close NAT entries
Initial DisclosureMalcolm Stagg disclosed NatJack at Black Hat USA 2026, identifying CVE-2026-63913 in Linux Netfilter conntrack, where a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active NAT entry into a closed state when conntrack fails to validate packet direction.
Show sources
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32