Medium severity5.9NVD Advisory· Published Oct 16, 2026

CVE-2026-102552

Description

Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply.

To remediate this issue, users should upgrade to version V4.4.2 and enable ipconfigDNS_CHECK_REPLY_SOURCE_IP.

Affected products

Amazon/Freertos Plus TCPllm-fuzzy
Range: <4.4.2

Patches

Vulnerability mechanics

References

aws.amazon.com/security/security-bulletins/2026-139-aws/nvd
github.com/FreeRTOS/FreeRTOS-Plus-TCP/releases/tag/V4.4.2nvd
github.com/FreeRTOS/FreeRTOS-Plus-TCP/security/advisories/GHSA-h4fw-pv82-p7h5nvd

News mentions

No linked articles in our index yet.

cvss	0.384
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000