# Fragment reassembly trusts unauthenticated flags

Reassembly that mixes fragments across keys, keeps stale state, or trusts plaintext header flags and length fields

_Area: Network devices and IoT. Seen in 3 disclosed reports; latest 2026-09-29. Updated 2026-10-23._

## How it works
Reassembly code assumes that fragments arriving for one logical message belong together and that header fields describing them are trustworthy. That assumption breaks in two ways. First, the state machine keeps fragments across a security boundary (reconnect, rekey, reassociation) or accepts fragments whose sequence/PN continuity was never checked, so pieces from different keys or sessions get glued together. Second, a length or flag field in the plaintext header is trusted to decide how the payload is parsed or how many bytes are retained, even though an attacker controls it. Either way the receiver builds a message the sender never legitimately sent.

## Where it shows up
- Defrag/A-MSDU caches not cleared on disconnect, rekey, or reassociation [E2](https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md)[E3](https://bugbountylibrary.com/r/h1%3A1238470.md)
- Fragment acceptance without consecutive packet-number or sequence enforcement [E2](https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md)[E3](https://bugbountylibrary.com/r/h1%3A1238470.md)
- Plaintext fragments accepted inside a protected network, or mixed plaintext/encrypted reassembly [E2](https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md)[E3](https://bugbountylibrary.com/r/h1%3A1238470.md)
- A header bit (e.g. A-MSDU flag) in the unauthenticated header changing how the encrypted payload is parsed [E3](https://bugbountylibrary.com/r/h1%3A1238470.md)
- One length field used to walk to the next header while a different field (fragment_length) governs bytes retained [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772.md)
- Reassembly buffers that retain whole records rather than the declared fragment, with no total-size check before copy [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772.md)

## How to review
Identify every reassembly cache and ask: what clears it, and is that event tied to the key/session that produced the fragments? The invariant that must hold: all fragments combined into one message must share the same key, session, and strictly increasing sequence/PN, and any header field that changes payload parsing must be authenticated or bound to that key. Separately, for each copy into a fixed buffer, confirm a running total-size check exists before the copy, and that the size accounted for matches the size actually copied [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772.md).

## Variants seen
- Stale fragment cache surviving reconnect/rekey, mixing fragments across keys [E2](https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md)
- Non-consecutive PNs accepted during reassembly [E2](https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md)[E3](https://bugbountylibrary.com/r/h1%3A1238470.md)
- Plaintext fragments accepted in a protected network [E2](https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md)[E3](https://bugbountylibrary.com/r/h1%3A1238470.md)
- Unauthenticated A-MSDU flag steering aggregation parsing [E3](https://bugbountylibrary.com/r/h1%3A1238470.md)
- Header length vs fragment_length mismatch causing oversized retention and heap overflow [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772.md)

## Impact and severity
Preauth heap overflow to RCE on an edge appliance [E1](https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772.md); packet injection and data exfiltration into protected WPA2/WPA3 networks across many OS stacks [E2](https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md)[E3](https://bugbountylibrary.com/r/h1%3A1238470.md). Severity rises when the flaw is preauth, reachable on a management/data plane, and affects widely deployed stacks. Missing size checks and missing cache-clearing both widen blast radius.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alabs-watchtowr-com-here-we-go-again-citrix-netscaler-dtls-preauth-memory-overflow-cve-2026-88772.md
- E2: https://bugbountylibrary.com/r/blog%3Agithub-com-vanhoefm-fragattacks.md
- E3: https://bugbountylibrary.com/r/h1%3A1238470.md