> CVE-2025-14299: TP-Link HTTP POST body DoS

An attacker sending a malformed HTTP POST request over LAN to a TP-Link Smart camera device can trigger the vulnerability described here. This report describes a malformed allocation length vulnerability which leads to denial of service. The vulnerability we are disclosing in this advisory affected a wide range of TP-Link devices, including TAPO Smart Cameras. A TP-Link Security Advisory released in April 2026 contains this vulnerability as CVE-2025-14299. Vulnerability Details This vulnerability is very similar to CVE-2025-0918, it is found in the same logic in the same function. In the HTTP Server implementation of TAPO devices, the http_recv_block function (in the main binary) is used to retrieve HTTP packets from the network into memory.