CVE-2026-74222

{
  "etk_id": "ETK-2026-24",
  "cve_id": "CVE-2026-74222",
  "display_id": "CVE-2026-74222",
  "ghsa_id": "GHSA-fm4f-g9jh-3qfq",
  "euvd_id": "EUVD-2026-89435",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Use-after-free in U-Boot lwIP wget handling",
  "summary": "U-Boot versions before 2026.10-rc5 are affected in the lwIP wget receive path. Processing HTTP data when local storage fails can cause use of released connection state and crash the bootloader. Exposure requires the affected lwIP wget functionality to process such HTTP traffic.",
  "mitigation": "Upgrade U-Boot to version 2026.10-rc5 or a later release. Until upgraded, disable or avoid the affected lwIP wget path where operationally feasible.",
  "vendor": "u-boot",
  "product": "u-boot",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2026.10-rc5"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.10-rc5"
      ],
      "package_name": "u-boot",
      "purl": null
    }
  ],
  "cwes": [
    416
  ],
  "cvss_score": 8.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.003,
  "epss_percentile": 0.2165,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 22.767205133333334,
  "t0_at": "2026-09-29T21:29:23.960000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-29T21:29:23.960000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-29T21:29:23.960000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-74222"
    }
  }
}