Hi,

The following vulnerability was published for ppp.

CVE-2026-75883[0]:
| The code in pppd that formats a response to a PEAP Request packet in
| peap_response() copies an entire TLS record of up to 16384 bytes
| into the fixed global buffer outpacket_buf  without checking the
| available space and without implementing outgoing  PEAP
| fragmentation. Thus a pppd process connecting to a server which
| requests PEAP authentication can be induced to corrupt global static
| data following the outpacket_buf array, most likely causing
| incorrect behavior or a crash.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-75883
https://www.cve.org/CVERecord?id=CVE-2026-75883
[1] https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35

Regards,
Salvatore