AIKIDO-2026-10242

TL;DR

Affected versions of this package are vulnerable to a buffer overflow caused by improper validation of socket file descriptor values when using the FD_SET macro. When a TCP connection is accepted with a file descriptor greater than or equal to FD_SETSIZE, FD_SET writes past the bounds of the fd_set structure, resulting in memory corruption or application crashes. An attacker can trigger this condition by exhausting available file descriptors so that newly accepted connections receive high-numbered descriptors, leading to a denial of service or potential memory corruption. The issue is fixed by validating file descriptor values and rejecting descriptors exceeding FD_SETSIZE before invoking FD_SET.