CVE-2020-24337: Altran Picotcp

High severity, CVSS 7.5. EPSS: 2.9% chance of exploitation in the next 30 days.

An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is provided in an incoming TCP packet, it is possible to cause a Denial-of-Service by achieving an infinite loop in the code that parses TCP options, aka tcp_parse_options() in pico_tcp.c.

Affected products

• Altran Picotcp: up to and including 1.7.0
• Altran Picotcp-NG: up to and including 1.7.0

Published 2020-12-11. Last modified 2026-06-17.