CVE detail
CVE-2026-0918
The Tapo C100 v5, C220 v1 and C520WS v2 cameras’ HTTP service does not safely handle POST requests containing an excessively large Content-Length header. The resulting failed memory allocation triggers a NULL pointer dereference, causing the main service process to crash. An unauthenticated attacker can repeatedly crash the service, causing temporary denial of service. The device restarts automatically, and repeated requests can keep it unavailable.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
- https://www.tp-link.com/us/support/faq/4923/www.tp-link.com
No excerpt available.
Vendor Advisorywww.tp-link.comJan 27, 2026, 6:15 PM - https://www.tp-link.com/us/support/download/tapo-c520ws/v2/www.tp-link.com
No excerpt available.
Vendor Advisorywww.tp-link.comJan 27, 2026, 6:15 PM - https://www.tp-link.com/us/support/download/tapo-c220/v1.60/www.tp-link.com
No excerpt available.
Vendor Advisorywww.tp-link.comJan 27, 2026, 6:15 PM - https://www.tp-link.com/us/support/download/tapo-c100/v5/www.tp-link.com
No excerpt available.
Vendor Advisorywww.tp-link.comJan 27, 2026, 6:15 PM - https://www.tp-link.com/en/support/download/tapo-c520ws/v2/www.tp-link.com
No excerpt available.
Vendor Advisorywww.tp-link.comJan 27, 2026, 6:15 PM - https://www.tp-link.com/en/support/download/tapo-c220/v1/www.tp-link.com
No excerpt available.
Vendor Advisorywww.tp-link.comJan 27, 2026, 6:15 PM - https://www.crac-learning.com/post/smart-home-security-research-cve-2026-0918-assignedwww.crac-learning.com
No excerpt available.
referencewww.crac-learning.comJan 27, 2026, 6:15 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-1315CVSS 7.1 · High
By sending crafted files to the firmware update endpoint of Tapo C220 v1 and C520WS v2, the device terminates core system services before verifying authentication or firmware inte…
- CVE-2026-0919CVSS 7.1 · High
The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanu…
- CVE-2026-8714CVSS 7.1 · High
A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input. Crafted inputs can trigge…
- CVE-2026-34124CVSS 7.1 · High
A denial-of-service vulnerability was identified in TP-Link Tapo C520WS v2.6 within the HTTP request path parsing logic. The implementation enforces length restrictions on the raw…
- CVE-2026-34122CVSS 7.1 · High
A stack-based buffer overflow vulnerability was identified in TP-Link Tapo C520WS v2.6 within a configuration handling component due to insufficient input validation. An attacker…
- CVE-2026-34121CVSS 8.7 · High
An authentication bypass vulnerability within the HTTP handling of the DS configuration service in TP-Link Tapo C520WS v2.6 was identified, due to inconsistent parsing and authori…