Linux Netfilter conntrack direction-validation flaw (CVE-2026-63913)
Vulnerability
Summary
Hide ▲
Show ▼
CVE-2026-63913 in Linux Netfilter conntrack lets a crafted SYN plus invalid reset packet prematurely close a NAT entry, creating session-state manipulation risk for affected systems. The flaw was fixed in stable Linux releases including 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. The issue was disclosed through the broader NatJack research and carries a CVSS score of 8.2.
Related Happenings
NatJack NAT-state attack research and proof-of-concept exploitation
Technical Analysis
H score21
First: 07.08.2026 12:32
Last: 07.08.2026 12:32
Sources 1
How related:
Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
About this happening:
NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increas...
NatJack NAT-state attack research and proof-of-concept exploitation
Technical AnalysisHow related: Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation (NAT) connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables.
About this happening: NatJack exposes a new NAT connection-state attack class that can hijack TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables, increas...
NatJack Windows and Linux NAT state-hijack flaws (multiple vulnerabilities)
Vulnerability
H score23
First: 07.08.2026 11:52
Last: 07.08.2026 11:52
Sources 1
How related:
Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack.
About this happening:
NatJack exposes Windows NAT used by Hyper-V and Linux Netfilter conntrack to session hijacking, DNS spoofing, and NAT-table exhaustion. Researchers assigne...
NatJack Windows and Linux NAT state-hijack flaws (multiple vulnerabilities)
VulnerabilityHow related: Two implementation-specific flaws have been assigned CVEs: CVE-2026-56181 (CVSS score: 8.3) in Windows NAT used by Hyper-V, and CVE-2026-63913 (CVSS score: 8.2) in Linux Netfilter conntrack.
About this happening: NatJack exposes Windows NAT used by Hyper-V and Linux Netfilter conntrack to session hijacking, DNS spoofing, and NAT-table exhaustion. Researchers assigne...
Timeline
-
07.08.2026 12:32 2 articles · 7h ago
Linux Netfilter conntrack flaw lets crafted packets close NAT entries
Initial DisclosureMalcolm Stagg disclosed NatJack at Black Hat USA 2026, identifying CVE-2026-63913 in Linux Netfilter conntrack, where a crafted SYN followed by a reset packet with an invalid sequence number can prematurely force an active NAT entry into a closed state when conntrack fails to validate packet direction.
Show sources
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32
- New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables — thehackernews.com — 07.08.2026 12:32