INC-20261110-8E50

Memory corruption in the gateway TLS stack under crafted handshakes · critical · aware 2026-11-10 10:13:57 UTC

Report (PDF) Edit

CRA — actively exploited vulnerability

Regulation (EU) 2024/2847, Article 14
  • Early warningArticle 14(2)(a)
    Submitted
    filed 2026-11-10 22:13:57 UTC

    Without undue delay and in any event within 24 hours of becoming aware.

  • Vulnerability notificationArticle 14(2)(b)
    Submitted
    filed 2026-11-12 04:13:57 UTC

    Within 72 hours of becoming aware of the actively exploited vulnerability.

  • Final reportArticle 14(2)(c)
    Not started
    — starts on a corrective or mitigating measure being available

    No later than 14 days after a corrective or mitigating measure is available. The clock does not start until that measure exists. · Draft it

Record a notification for CRA — actively exploited vulnerability
The real moment it went out. The one-month final-report clock runs from this.

What was actually sent

2
Submitted (UTC)RegimeStageToRef
2026-11-10 22:13 CRA early CRA single reporting platformPortal CRA-2026-4455
2026-11-12 04:13 CRA notify CRA single reporting platformPortal CRA-2026-4455-N

Evidence

0 files

Nothing attached. Screenshots of the portal acknowledgment, the sent notification, and the technical analysis live here.

PDF, PNG, JPEG or WebP, up to 10 MB. The file itself has to be one of those — the name is not enough.
×
Live demo — signed in as the admin, sample data resets hourly.
Own it — one payment →