lldpd (802.1Q VLAN tag stripping in lldpd_decode): lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload four

Impact

lldpd strips 802.1Q VLAN tags by memmove-ing the frame payload four bytes left, and the byte count is not correctly bounded — so a crafted tagged frame drives a bad copy. Worth noting for anyone running lldpd on trunk ports, which in a leaf/spine fabric is most of them.

Who can reach it

Unauthenticated, adjacent — a crafted VLAN-tagged Ethernet frame on a port where lldpd is listening.

What to do

Upgrade lldpd to 1.0.22 or later and restart the daemon. Package upgrade plus service restart; on switch NOSes it comes with the image update.

References

Related entries

• Apache Airflow: Bulk Variables API skips key-based redaction, returning JSON variable secrets in cleartextCVE-2026-48828 · Apache Airflow (Bulk Variables API, secrets masker key-based redaction)Medium
• Apache Airflow: Config API exposes secrets-backend kwargs overrides unmasked, leaking Vault credentialsCVE-2026-48892 · Apache Airflow (Config API, per-key secrets-backend environment overrides)Medium
• Apache Airflow: Dag source endpoint returns the whole file, exposing co-located Dags the caller cannot readCVE-2026-49296 · Apache Airflow (Dag source endpoint, GET /api/v2/dagSources/{dag_id})Medium
• Apache Airflow: task-instance API returns deferred trigger kwargs unmasked, exposing secrets passed to triggersCVE-2026-49487 · Apache Airflow (REST API task-instance endpoints, deferred trigger kwargs)Medium
• Dell OpenManage Server Administrator (relative path traversal): A low-privileged remote attacker reads arbitrary filesCVE-2026-56794 · Dell OpenManage Server Administrator (relative path traversal)Medium
• Apache Airflow: JSON Variable secrets shown in cleartext in the Rendered Templates viewCVE-2026-59244 · Apache Airflow secrets masker (Rendered Templates view, var.json dict values)Medium