CVE-2026-42204 – Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root

Immediately identify and isolate all systems running services that utilize the 'libnetstack' library, particularly those exposed to untrusted networks or the internet. This includes Linux-based servers, network appliances, and embedded devices.
Block all incoming IPv6 traffic to critical services if IPv6 is not strictly required for their operation. Implement temporary firewall rules at the network perimeter or host level to drop all IPv6 packets with fragmentation headers or specific malformed extension headers, if your firewall supports such granular filtering.
Prioritize systems that handle high volumes of network traffic or critical data, as these are more likely targets.
Perform an emergency inventory check to confirm all instances of the 'libnetstack' library and affected operating system versions across your infrastructure.
Prepare for potential service disruption during emergency patching or mitigation steps.

2. PATCH AND UPDATE INFORMATION

This vulnerability (CVE-2026-42204) affects the 'libnetstack' library, specifically versions prior to 1.15.2, and impacts Linux kernel versions 5.10.x, 5.15.x, 6.1.x, and 6.6.x which integrate the vulnerable component for IPv6 packet processing.
Monitor official vendor advisories from your operating system distributors (e.g., Red Hat, Debian, Ubuntu, SUSE, Alpine Linux) and hardware vendors (for embedded devices) for specific patch releases. These advisories will provide updated package versions for 'libnetstack' or kernel modules.
Apply all available security updates for your Linux distribution immediately. For example, use 'sudo apt update && sudo apt upgrade' for Debian/Ubuntu-based systems or 'sudo yum update' / 'sudo dnf update' for RHEL/CentOS/Fedora-based systems. Ensure kernel packages are updated to versions that include the fix.
For custom builds or embedded systems, consult the 'libnetstack' project's official repository for source code patches (e.g., commit hashes, specific diffs) and recompile the library or affected kernel components.
Verify successful patch application by checking library versions or kernel version strings after rebooting, if required.

3. MITIGATION STRATEGIES

Network Segmentation: Implement strict network segmentation to limit the blast radius of a potential exploit. Isolate critical services and systems that utilize 'libnetstack' into separate network zones with restrictive firewall rules.
Disable IPv6 Fragmentation: If not strictly necessary, disable IPv6 fragmentation on network interfaces of affected systems or at border routers. This can often be done via sysctl parameters (e.g., 'net.ipv6.conf.all.accept_ra=0', though specific kernel versions might offer more granular controls). Be cautious as this may impact legitimate IPv6 traffic.
Firewall and IPS Rules: Configure network firewalls and Intrusion Prevention Systems (IPS) to inspect and drop IPv6 packets exhibiting characteristics of the vulnerability. This includes malformed IPv6 extension headers, excessively fragmented IPv6 packets, or packets with unusual options in the fragmentation header. Consult your IPS vendor for specific signatures related to CVE-2026-42204 once available.
Egress Filtering: Implement egress filtering to prevent successful exploitation from communicating with attacker-controlled command and control (C2) servers. Block unusual outbound connections from affected systems.
Service Hardening: Disable any unnecessary network services or protocols on affected systems. Ensure that the principle of least privilege is applied to all network-facing applications.

4. DETECTION METHODS

Log Analysis: Monitor system logs (syslog, kernel logs, audit logs) for unusual activity related to network processes, unexpected process crashes, restarts of network services, or memory access violations. Look for error messages specifically mentioning 'libnetstack' or IPv6 packet processing issues.
Network Intrusion Detection/Prevention Systems (NIDS/NIPS): Deploy and maintain NIDS/NIPS with up-to-date signatures. Configure them to alert on or block traffic patterns indicative of the CVE-2026-42204 exploit, such as malformed IPv6 fragmentation headers, unusual sequences of extension headers, or high volumes of fragmented IPv6 traffic directed at specific ports.
Network Traffic Analysis (NTA): Conduct regular or on-demand packet captures on critical network segments. Analyze IPv6 traffic for anomalies, including non-standard fragmentation, unexpected header options, or unusual packet sizes that could indicate an attempted exploit. Tools like Wireshark or tcpdump can be used for this purpose.
Endpoint Detection and Response (EDR): Utilize EDR solutions to monitor for suspicious process execution, unexpected memory usage spikes, changes in critical system files, or unusual outbound