What’s Vulnerable › Vulnerabilities

CVE-2026-0919: Unauthenticated Denial of Service via Oversized URL in HTTP Parser on TP-Link Tapo C210, C220 & C520WS

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-27 · updated 2026-06-17
• Weakness: CWE-20

Description

The HTTP parser of Tapo C210 v3, C220 v1 and C520WS v2 cameras improperly handles requests containing an excessively long URL path. An invalid‑URL error path continues into cleanup code that assumes allocated buffers exist, leading to a crash and service restart. An unauthenticated attacker can force repeated service crashes or device reboots, causing denial of service.

Affected products

• TP-Link Tapo C220 Firmware: before 1.4.2 — fixed in 1.4.2
• TP-Link Systems Inc. Tapo C520WS v2: before 1.2.3 — fixed in 1.2.3

How to fix

Upgrade to a fixed version: TP-Link Tapo C220 Firmware 1.4.2; TP-Link Systems Inc. Tapo C520WS v2 1.2.3. Check the vendor advisory for mitigations.

References

• https://www.tp-link.com/en/support/download/tapo-c210/v3/
• https://www.tp-link.com/en/support/download/tapo-c220/v1/
• https://www.tp-link.com/en/support/download/tapo-c520ws/v2/
• https://www.tp-link.com/us/support/download/tapo-c210/v3/
• https://www.tp-link.com/us/support/download/tapo-c220/v1.60/
• https://www.tp-link.com/us/support/download/tapo-c520ws/v2/
• https://www.tp-link.com/us/support/faq/4923/

Get alerted when CVE-2026-0919 or the next vulnerability affects your stack