{"metadata": {"vulnerability": "CVE-2026-99059", "count": 23, "kinds": {"milestone": 7, "sighting": 2, "kev": 0, "other": 14}}, "data": [{"timestamp": "2026-09-25T10:25:14.388Z", "date_only": false, "value": "2026-09-25T10:25:14.388Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-99059", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-23T12:22:47.559Z", "date_only": false, "value": "2026-10-23T12:22:47.559Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99059", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T13:17:00Z", "date_only": false, "value": "2026-10-23T13:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99059", "record": "UBUNTU-CVE-2026-99059", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T13:17:29Z", "date_only": false, "value": "2026-10-23T13:17:29Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C2JQ-9MFV-9WQH", "record": "GHSA-C2JQ-9MFV-9WQH", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-10-23T13:17:29.620Z", "date_only": false, "value": "2026-10-23T13:17:29.620", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99059", "record": "FKIE_CVE-2026-99059", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-23T14:19:50.216Z", "date_only": false, "value": "2026-10-23T14:19:50.216441Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117490659462649053", "record": "CVE-2026-99059", "field": "creation_timestamp", "uuid": "3f416d7e-ce7b-494a-a034-aa9c7d76c9d6", "content": "CVE-2026-99059 wireguard: noise: reject response consumption after intermediate initiation In the Linux kernel, the following vulnerability has been resolved:\nwireguard: noise: reject response consumption after intermediate initiation\nTwo threads begin processing the identical response message, receivedtwice. The first thread, A, runs. While it's running, the second one,B, gets partway through, and during that slow calculation, or even whileblocking on down_write(), A completes and then also a handshakeinitiation that's already been queued up runs in thread C, which itselftakes that same down_write(). The handshake initiation creationsucceeds, and sets the state back to waiting-for-response, and callsup_write(), at which point thread B resumes, because either its finishedits calculations or was finally allowed to acquire down_write(). ThreadB then copies the state back to the peer, and begins a new session,using that state, which is the same session as the one made in thread A.\nThread A\t\t\tThread B\t\t\tThread C\ndown_read() sA = handshake->state memcpy(cA, handshake->crypto)up_read()if (sA != 1) goto failslow_crypto(cA)\t\t\t\tdown_read()\t\t\t\t sB = handshake->state\t\t\t\t memcpy(cB, handshake->crypto)\t\t\t\tup_read()\t\t\t\tif (sB != 1)\t\t\t\t goto fail\t\t\t\tslow_crypto(cB)down_write() if (sA != handshake->state)  goto fail memcpy(handshake->crypto, cA) handshake->state = 2up_write()down_write() if (handshake->state != 2)  goto fail derive_session(handshake->crypto)up_write()\t\t\t\t\t\t\t\tdown_write()\t\t\t\t\t\t\t\t slow_crypto(handshake->crypto)\t\t\t\t\t\t\t\t handshake->state = 1\t\t\t\t\t\t\t\tup_write()\t\t\t\tdown_write()\t\t\t\t if (sB != handshake->state)\t\t\t\t   goto fail\t\t\t\t memcpy(handshake->crypto, cB)\t\t\t\t handshake->state = 2\t\t\t\tup_write()\t\t\t\tdown_write()\t\t\t\t if (handshake->state != 2)\t\t\t\t  goto fail\t\t\t\t derive_session(handshake->crypto)\t\t\t\tup_write()\nThis seems basically impossible to hit in a meaningful way in practice,but ensure that it absolutely cannot happen by comparing the ephemeralprivate key that's on the stack with the latest one that the peer'shandshake state has.\nhttps://www.cve.org/CVERecord?id=CVE-2026-99059https://git.kernel.org/stable/c/fb5ce4c7790c3eeec820302d08d70ecf46af4295https://git.kernel.org/stable/c/c76a80db593096edf2b3b3972f58b6342a8c6c04https://git.kernel.org/stable/c/4d64a3d6e96aa78619c9c29ffde309794974588ahttps://git.kernel.org/stable/c/3bec3d32c2a3afd164fc87f95457df2cf9049c20https://git.kernel.org/stable/c/d0305f8d90029556260c6824b61c493c424eba9e#kernel #Linux#CVE_2026_99059#bot", "url": "https://infosec.exchange/users/cve/statuses/117490659462649053"}, {"timestamp": "2026-10-23T15:31:36Z", "date_only": false, "value": "2026-10-23T15:31:36Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C2JQ-9MFV-9WQH", "record": "GHSA-C2JQ-9MFV-9WQH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:04:53Z", "date_only": false, "value": "2026-10-25T01:04:53.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "document.tracking.revision_history.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:04:53Z", "date_only": false, "value": "2026-10-25T01:04:53.000Z", "kind": "other", "label": "None available", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "vulnerabilities.0.remediations.0.date", "linked_record": true}, {"timestamp": "2026-10-25T01:04:53Z", "date_only": false, "value": "2026-10-25T01:04:53.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-25T01:05:56Z", "date_only": false, "value": "2026-10-25T01:05:56.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "document.tracking.revision_history.1.date", "linked_record": true}, {"timestamp": "2026-10-26T14:48:21Z", "date_only": false, "value": "2026-10-26T14:48:21.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "document.tracking.revision_history.2.date", "linked_record": true}, {"timestamp": "2026-10-28T06:07:58.266Z", "date_only": false, "value": "2026-10-28T06:07:58.266770Z", "kind": "milestone", "label": "Published", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99059", "record": "BELL-CVE-2026-99059", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-10-29T20:02:40.426Z", "date_only": false, "value": "2026-10-29T20:02:40.426054Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/bootintel.bsky.social/post/3mz22oqpo6z2n", "record": "CVE-2026-99059", "field": "creation_timestamp", "uuid": "5b682428-a9de-4026-ac48-15a6d1cc112b", "content": "HIGH severity CVE just published in WireGuard:\n\nCVE-2026-99059. wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. Whil\u2026\n\nnvd.nist.gov/vuln/detail/CVE-2026-99059", "url": "https://bsky.app/profile/bootintel.bsky.social/post/3mz22oqpo6z2n"}, {"timestamp": "2026-10-30T12:41:25.597Z", "date_only": false, "value": "2026-10-30T12:41:25.597Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-99059", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-30T12:41:25.597Z", "date_only": false, "value": "2026-10-30T12:41:25.597Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Linux", "record": "CVE-2026-99059", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-30T13:21:42.723Z", "date_only": false, "value": "2026-10-30T13:21:42.723", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-99059", "record": "FKIE_CVE-2026-99059", "field": "lastModified", "linked_record": true}, {"timestamp": "2026-10-30T15:34:17Z", "date_only": false, "value": "2026-10-30T15:34:17Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C2JQ-9MFV-9WQH", "record": "GHSA-C2JQ-9MFV-9WQH", "field": "modified", "linked_record": true}, {"timestamp": "2026-10-30T19:03:41Z", "date_only": false, "value": "2026-10-30T19:03:41Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-99059", "record": "UBUNTU-CVE-2026-99059", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-01T15:05:33Z", "date_only": false, "value": "2026-11-01T15:05:33.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "document.tracking.revision_history.3.date", "linked_record": true}, {"timestamp": "2026-11-01T15:05:33Z", "date_only": false, "value": "2026-11-01T15:05:33.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "document.tracking.current_release_date", "linked_record": true}, {"timestamp": "2026-11-02T08:02:48.149Z", "date_only": false, "value": "2026-11-02T08:02:48.149Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-99059", "record": "MSRC_CVE-2026-99059", "field": "document.tracking.generator.date", "linked_record": true}, {"timestamp": "2026-11-03T20:04:10.377Z", "date_only": false, "value": "2026-11-03T20:04:10.377257Z", "kind": "other", "label": "Updated", "source": "osv_bellsoft \u00b7 BELL-CVE-2026-99059", "record": "BELL-CVE-2026-99059", "field": "modified", "linked_record": true}], "metrics": {"as_of": "2026-11-05T22:06:58.291Z", "anchors": {"origin": {"timestamp": "2026-10-23T12:22:47.559Z", "date_only": false, "value": "2026-10-23T12:22:47.559Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99059", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-23T12:22:47.559Z", "date_only": false, "value": "2026-10-23T12:22:47.559Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99059", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 1158250.732364, "hours": 321.73631454555556, "days": 13.405679772731482, "min_seconds": 1158250.732364, "max_seconds": 1158250.732364, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-23T12:22:47.559Z", "date_only": false, "value": "2026-10-23T12:22:47.559Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-99059", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-05T22:06:58.291Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}