Hi,

The following vulnerabilities were published for libslirp.

CVE-2026-120830[0]:
| A flaw was found in libslirp in icmp_forward_error(). When building
| an ICMP error response, the length of the quoted original IPv4
| packet was taken from the IP header without clamping it to the
| actual buffer length. A truncated or malformed packet could cause an
| out-of-bounds heap read, leaking host memory into the ICMP error
| packet returned to a guest or container.

Fixed by: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/21b33a6c5588af9f58d15e528fdc1019452708e4

CVE-2026-120831[1]:
| A flaw was found in libslirp in if_output(). When moving a session
| from the fast queue to the batch queue, the code unlinked and
| reinserted an arbitrary packet via ifm->m_nextpkt instead of the
| session queue head, corrupting queue pointers. A guest generating
| burst traffic could crash the host networking process, causing a
| denial of service.

Fixed by: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/bad35bd3b529dc47aa109980a69a36da7848ab76

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-120830
https://www.cve.org/CVERecord?id=CVE-2026-120830
[1] https://security-tracker.debian.org/tracker/CVE-2026-120831
https://www.cve.org/CVERecord?id=CVE-2026-120831

Please adjust the affected versions in the BTS as needed.