ThreatCluster

Multiple CVEs Identified in mptcp Implementation

First seen 18 Feb 2026, 15:24 UTC Api.Msrc.Microsoft 41

Article Content

Browse articles
ThreatCluster

Two new Common Vulnerabilities and Exposures (CVEs) related to the mptcp implementation have been published. CVE-2025-68291, published on December 16, 2025, addresses an issue with initializing rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). CVE-2025-71088, published on January 13, 2026, involves fallback behavior on simultaneous connections.

Timeline

2025-12-16
CVE-2025-68291 published
2026-01-13
CVE-2025-71088 published
2026-02-18
Articles published regarding both CVEs