Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-103547 (GCVE-0-2026-103547)

Vulnerability from nvd – Published: 2026-09-30 19:40 – Updated: 2026-09-30 19:55

Summary

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:55 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://www.openbsd.org/errata79.html
https://github.com/openbsd/src/commit/4f3f58e83c2…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/c…
https://www.openbsd.org/errata78.html

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.8 , < errata 057 (custom) Affected: 7.9 , < errata 021 (custom) cpe:2.3:o:openbsd:openbsd:::::::: cpe:2.3:o:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103547",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:55:41.738525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:55:54.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "repo": "https://github.com/openbsd/src",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "errata 057",
              "status": "affected",
              "version": "7.8",
              "versionType": "custom"
            },
            {
              "lessThan": "errata 021",
              "status": "affected",
              "version": "7.9",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "errata 057",
                  "versionStartIncluding": "7.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "errata 021",
                  "versionStartIncluding": "7.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:40:53.200Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openbsd.org/errata79.html"
        },
        {
          "url": "https://github.com/openbsd/src/commit/4f3f58e83c2a6d239c544236a9d4d76c74bbf960"
        },
        {
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/common/021_ldapd.patch.sig"
        },
        {
          "url": "https://www.openbsd.org/errata78.html"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-103547",
    "datePublished": "2026-09-30T19:40:53.200Z",
    "dateReserved": "2026-09-30T19:40:52.241Z",
    "dateUpdated": "2026-09-30T19:55:54.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56101 (GCVE-0-2026-56101)

Vulnerability from nvd – Published: 2026-09-08 16:00 – Updated: 2026-09-10 15:02 X_Open Source

Title

OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

Summary

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 13:49 UTC

CWE

CWE-697 - Incorrect Comparison

Assigner

VulnCheck mitre root Scorecard

References

3 references

URL	Tags
https://pop.argus-systems.ai/advisory/adv-209.html	technical-descriptionexploit
https://github.com/openbsd/src/commit/1ee99dfcc4d…	patch
https://www.vulncheck.com/advisories/openbsd-ieee…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , < 1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a (git)

Date Public

2026-07-15 00:00

Credits

Argus Systems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56101",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T13:49:14.964977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:02:16.176Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/openbsd/src",
          "product": "OpenBSD",
          "repo": "https://github.com/openbsd/src",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Argus Systems"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-697",
              "description": "Incorrect Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T16:00:30.572Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Argus Systems Advisory",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://pop.argus-systems.ai/advisory/adv-209.html"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openbsd/src/commit/1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openbsd-ieee80211-crypto-tkip-c-tkip-mic-countermeasure-logic-inversion-dos"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56101",
    "datePublished": "2026-09-08T16:00:30.572Z",
    "dateReserved": "2026-06-18T19:15:10.649Z",
    "dateUpdated": "2026-09-10T15:02:16.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57589 (GCVE-0-2026-57589)

Vulnerability from nvd – Published: 2026-06-25 00:33 – Updated: 2026-06-26 03:55

Summary

sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mitre mitre root Scorecard

References

2 references

URL	Tags
https://github.com/openbsd/src/commit/1957873d206…
https://openai.com/index/patch-the-planet/

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , ≤ 7.9 (custom) cpe:2.3:o:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T03:55:33.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThanOrEqual": "7.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "7.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T00:33:04.749Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d"
        },
        {
          "url": "https://openai.com/index/patch-the-planet/"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-57589",
    "datePublished": "2026-06-25T00:33:04.749Z",
    "dateReserved": "2026-06-25T00:33:04.330Z",
    "dateUpdated": "2026-06-26T03:55:33.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56099 (GCVE-0-2026-56099)

Vulnerability from nvd – Published: 2026-06-18 19:29 – Updated: 2026-07-14 21:33 X_Open Source

Title

OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input

Summary

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 20:44 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://pop.argus-systems.ai/advisory/adv-040.html	technical-descriptionexploit
https://github.com/openbsd/src/commit/6a23123ec05…	patch
https://www.vulncheck.com/advisories/openbsd-mpls…	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/06/19/3
http://seclists.org/fulldisclosure/2026/Jun/17

Impacted products

1 product

Vendor	Product	Version
openbsd	src	Affected: 0 , < 6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd (git)

Date Public

2026-06-18 00:00

Credits

Argus Systems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-21T07:37:24.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/19/3"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2026/Jun/17"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T20:44:12.654787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T20:44:20.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/openbsd/src",
          "product": "src",
          "repo": "https://github.com/openbsd/src",
          "vendor": "openbsd",
          "versions": [
            {
              "lessThan": "6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Argus Systems"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T21:33:59.892Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://pop.argus-systems.ai/advisory/adv-040.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-input"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56099",
    "datePublished": "2026-06-18T19:29:08.271Z",
    "dateReserved": "2026-06-18T19:15:10.649Z",
    "dateUpdated": "2026-07-14T21:33:59.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55706 (GCVE-0-2026-55706)

Vulnerability from nvd – Published: 2026-06-17 00:53 – Updated: 2026-06-17 14:33

Summary

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 14:32 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://blog.argus-systems.ai/blog/openbsd-pap-27…
https://www.openwall.com/lists/oss-security/2026/…
https://github.com/openbsd/src/commit/076e2b1c1fc…
https://blog.argus-systems.ai/blog/poc-001-pap-by…	exploit

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , < 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8 (git) cpe:2.3:o:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55706",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T14:32:57.493186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T14:33:01.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://blog.argus-systems.ai/blog/poc-001-pap-bypass.py"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "076e2b1c1fc4ac0883a72d3544131ad5cee7adf8",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "076e2b1c1fc4ac0883a72d3544131ad5cee7adf8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T00:53:23.246Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/06/16/9"
        },
        {
          "url": "https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-55706",
    "datePublished": "2026-06-17T00:53:23.246Z",
    "dateReserved": "2026-06-17T00:53:22.791Z",
    "dateUpdated": "2026-06-17T14:33:01.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41285 (GCVE-0-2026-41285)

Vulnerability from nvd – Published: 2026-04-20 00:00 – Updated: 2026-04-21 13:27

Summary

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-21 13:27 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
https://www.rfc-editor.org/rfc/rfc4861#section-4.6
https://github.com/openbsd/src/commit/086c5738bcd…
https://www.openbsd.org/errata78.html

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , ≤ 7.8 (custom) cpe:2.3:a:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41285",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T13:27:20.927005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T13:27:42.310Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThanOrEqual": "7.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "7.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an \"nd_opt_len * 8 - 2\" expression with no preceding check for whether nd_opt_len is zero."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-20T23:27:57.468Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.rfc-editor.org/rfc/rfc4861#section-4.6"
        },
        {
          "url": "https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f"
        },
        {
          "url": "https://www.openbsd.org/errata78.html"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-41285",
    "datePublished": "2026-04-20T00:00:00.000Z",
    "dateReserved": "2026-04-20T00:00:00.000Z",
    "dateUpdated": "2026-04-21T13:27:42.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-30334 (GCVE-0-2025-30334)

Vulnerability from nvd – Published: 2025-03-20 20:39 – Updated: 2025-03-21 15:22

Title

OpenBSD wg(4) kernel crash

Summary

In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2025-03-05 19:18 UTC

CWE

CWE-131 - Incorrect Calculation of Buffer Size

Assigner

cisa-cg CISA root Scorecard

References

3 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/c…
https://github.com/openbsd/src/commit/c0619985973…

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.6 , < 7.6 errata 006 (custom) Unaffected: 7.6 errata 008 Affected: 7.5 , < 7.5 errata 015 (custom) Unaffected: 7.5 errata 015

Date Public

2025-01-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30334",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T15:21:31.344583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T15:22:01.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.6 errata 006",
              "status": "affected",
              "version": "7.6",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.6 errata 008"
            },
            {
              "lessThan": "7.5 errata 015",
              "status": "affected",
              "version": "7.5",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.5 errata 015"
            }
          ]
        }
      ],
      "datePublic": "2025-01-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2025-30334",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2025-03-05T19:18:47.764235Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "CWE-131 Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-20T21:58:11.624Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/006_wg.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/015_wg.patch.sig"
        },
        {
          "name": "url",
          "url": "https://github.com/openbsd/src/commit/c06199859734d958552a581d72b4c0f910e68d7c"
        }
      ],
      "title": "OpenBSD wg(4) kernel crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2025-30334",
    "datePublished": "2025-03-20T20:39:16.232Z",
    "dateReserved": "2025-03-20T20:14:34.240Z",
    "dateUpdated": "2025-03-21T15:22:01.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11149 (GCVE-0-2024-11149)

Vulnerability from nvd – Published: 2024-12-06 01:56 – Updated: 2024-12-06 16:41

Title

OpenBSD vmm GDTR limits

Summary

In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs.

Severity

6.2 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:H/AU:N

7.9 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-06 14:11 UTC

CWE

CWE-noinfo Not enough information

Assigner

cisa-cg CISA root Scorecard

References

1 reference

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.4 , < 7.4 errata 014 (custom) Unaffected: 7.4 errata 014

Date Public

2024-02-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-06T14:11:42.541995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-06T16:41:55.500Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.4 errata 014",
              "status": "affected",
              "version": "7.4",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.4 errata 014"
            }
          ]
        }
      ],
      "datePublic": "2024-02-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:H/AU:N",
            "version": "4.0"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-noinfo Not enough information",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-06T01:56:12.697Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/014_vmm.patch.sig"
        }
      ],
      "title": "OpenBSD vmm GDTR limits"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-11149",
    "datePublished": "2024-12-06T01:56:12.697Z",
    "dateReserved": "2024-11-12T15:39:38.790Z",
    "dateUpdated": "2024-12-06T16:41:55.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11148 (GCVE-0-2024-11148)

Vulnerability from nvd – Published: 2024-12-05 19:50 – Updated: 2024-12-06 18:58

Title

OpenBSD httpd(8) null dereference

Summary

In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-06 18:57 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/c…

Impacted products

2 products

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.4 , < 7.4 errata 006 (custom) Unaffected: 7.4 errata 006 Affected: 7.3 , < 7.3 errata 020 (custom) Unaffected: 7.3 errata 020
openbsd	openbsd	Affected: 7.4_errata006 Affected: 7.3_errata020 cpe:2.3:a:openbsd:openbsd:-:::::::*

Date Public

2023-11-21 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:openbsd:openbsd:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "status": "affected",
                "version": "7.4_errata006"
              },
              {
                "status": "affected",
                "version": "7.3_errata020"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-06T18:57:22.246744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-06T18:58:45.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.4 errata 006",
              "status": "affected",
              "version": "7.4",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.4 errata 006"
            },
            {
              "lessThan": "7.3 errata 020",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.3 errata 020"
            }
          ]
        }
      ],
      "datePublic": "2023-11-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T19:50:19.954Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/006_httpd.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/020_httpd.patch.sig"
        }
      ],
      "title": "OpenBSD httpd(8) null dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-11148",
    "datePublished": "2024-12-05T19:50:19.954Z",
    "dateReserved": "2024-11-12T15:39:23.020Z",
    "dateUpdated": "2024-12-06T18:58:45.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10933 (GCVE-0-2024-10933)

Vulnerability from nvd – Published: 2024-12-05 20:06 – Updated: 2024-12-05 20:40

Title

OpenBSD readdir directory traversal

Summary

In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems.

Severity

4.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-05 20:40 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/c…

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.5 , < 7.5 errata 009 (custom) Affected: 7.4 , < 7.4 errata 022 (custom) Unaffected: 7.5 errata 009 Unaffected: 7.4 errata 022

Date Public

2024-09-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10933",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T20:40:39.299892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-05T20:40:58.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.5 errata 009",
              "status": "affected",
              "version": "7.5",
              "versionType": "custom"
            },
            {
              "lessThan": "7.4 errata 022",
              "status": "affected",
              "version": "7.4",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.5 errata 009"
            },
            {
              "status": "unaffected",
              "version": "7.4 errata 022"
            }
          ]
        }
      ],
      "datePublic": "2024-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any \u0027/\u0027 in readdir name validation to avoid unexpected directory traversal on untrusted file systems."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T20:06:23.001Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/022_readdir.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/009_readdir.patch.sig"
        }
      ],
      "title": "OpenBSD readdir directory traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-10933",
    "datePublished": "2024-12-05T20:06:23.001Z",
    "dateReserved": "2024-11-06T18:12:15.857Z",
    "dateUpdated": "2024-12-05T20:40:58.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10934 (GCVE-0-2024-10934)

Vulnerability from nvd – Published: 2024-11-15 19:20 – Updated: 2025-10-02 14:09

Title

OpenBSD NFS double-free vulnerability

Summary

In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-15 19:46 UTC

CWE

CWE-415 - Double Free
CWE-457 - Use of Uninitialized Variable

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…

Impacted products

2 products

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.5 Affected: 7.4
openbsd	openbsd	Affected: 7.5 , < 7.5_errata_008 (custom) Affected: 7.4 , < 7.4_errata_021 (custom) cpe:2.3:o:openbsd:openbsd::::::::

Date Public

2024-11-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "lessThan": "7.5_errata_008",
                "status": "affected",
                "version": "7.5",
                "versionType": "custom"
              },
              {
                "lessThan": "7.4_errata_021",
                "status": "affected",
                "version": "7.4",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10934",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T19:46:59.490027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T19:47:11.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "7.4"
            }
          ]
        }
      ],
      "datePublic": "2024-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415 Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "CWE-457 Use of Uninitialized Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-02T14:09:00.828Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig"
        }
      ],
      "title": "OpenBSD NFS double-free vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-10934",
    "datePublished": "2024-11-15T19:20:02.231Z",
    "dateReserved": "2024-11-06T18:12:18.387Z",
    "dateUpdated": "2025-10-02T14:09:00.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43688 (GCVE-0-2024-43688)

Vulnerability from nvd – Published: 2024-08-20 00:00 – Updated: 2024-08-26 13:23

Summary

cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-26 13:17 UTC

CWE

n/a
CWE-787 - Out-of-bounds Write

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
https://www.supernetworks.org/advisories/CVE-2024…
https://github.com/vixie/cron/commit/9cc8ab1087bb…
https://www.supernetworks.org/CVE-2024-43688/open…

Impacted products

3 products

Vendor	Product	Version
vixie	cron	Affected: 0 , < 9cc8ab1 (custom) cpe:2.3:a:vixie:cron::::::::
openbsd	openbsd	Affected: 7.4 cpe:2.3:o:openbsd:openbsd:7.4:::::::*
openbsd	openbsd	Affected: 7.5 cpe:2.3:o:openbsd:openbsd:7.5:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vixie:cron:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cron",
            "vendor": "vixie",
            "versions": [
              {
                "lessThan": "9cc8ab1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:7.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "status": "affected",
                "version": "7.4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:7.5:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "status": "affected",
                "version": "7.5"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-43688",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-26T13:17:12.595187Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T13:23:36.277Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-26T06:03:33.171Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.supernetworks.org/advisories/CVE-2024-43688-openbsd-cron-heap-underflow.txt"
        },
        {
          "url": "https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712"
        },
        {
          "url": "https://www.supernetworks.org/CVE-2024-43688/openbsd-cron-heap-underflow.txt"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-43688",
    "datePublished": "2024-08-20T00:00:00.000Z",
    "dateReserved": "2024-08-14T00:00:00.000Z",
    "dateUpdated": "2024-08-26T13:23:36.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35000 (GCVE-0-2021-35000)

Vulnerability from nvd – Published: 2024-05-07 22:54 – Updated: 2024-09-18 18:27

Title

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability

Summary

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-16112.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-08 14:50 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

zdi mitre root Scorecard

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
OpenBSD	Kernel	Affected: OpenBSD 6.9

Date Public

2022-01-06 13:24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-08T14:50:29.518755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:12:34.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:26:55.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-22-012",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-012/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kernel",
          "vendor": "OpenBSD",
          "versions": [
            {
              "status": "affected",
              "version": "OpenBSD 6.9"
            }
          ]
        }
      ],
      "dateAssigned": "2021-06-30T13:56:51.764Z",
      "datePublic": "2022-01-06T13:24:06.686Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.\n. Was ZDI-CAN-16112."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-18T18:27:57.926Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-22-012",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-012/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Reno Robert of Trend Micro Zero Day Initiative"
      },
      "title": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2021-35000",
    "datePublished": "2024-05-07T22:54:52.586Z",
    "dateReserved": "2021-06-17T19:27:05.669Z",
    "dateUpdated": "2024-09-18T18:27:57.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-34999 (GCVE-0-2021-34999)

Vulnerability from nvd – Published: 2024-05-07 22:54 – Updated: 2024-09-18 18:19

Title

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability

Summary

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-14540.

Severity

3.8 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-08 15:31 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

zdi mitre root Scorecard

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

2 products

Vendor	Product	Version
OpenBSD	Kernel	Affected: OpenBSD 6.9
openbsd	openbsd	Affected: 0 , < 7.0 (custom) cpe:2.3:o:openbsd:openbsd::::::::

Date Public

2022-01-13 13:45

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:26:55.938Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-22-073",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-073/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "lessThan": "7.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-34999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-08T15:31:35.373260Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T21:11:13.017Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kernel",
          "vendor": "OpenBSD",
          "versions": [
            {
              "status": "affected",
              "version": "OpenBSD 6.9"
            }
          ]
        }
      ],
      "dateAssigned": "2021-06-30T13:56:51.762Z",
      "datePublic": "2022-01-13T13:45:04.504Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.\n. Was ZDI-CAN-14540."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-18T18:19:31.677Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-22-073",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-073/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Reno Robert of Trend Micro Zero Day Initiative"
      },
      "title": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2021-34999",
    "datePublished": "2024-05-07T22:54:51.785Z",
    "dateReserved": "2021-06-17T19:27:05.669Z",
    "dateUpdated": "2024-09-18T18:19:31.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-29937 (GCVE-0-2024-29937)

Vulnerability from nvd – Published: 2024-03-21 00:00 – Updated: 2025-03-13 15:58

Summary

NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-21 01:37 UTC

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://www.signedness.org/t2.fi.2024/
https://www.youtube.com/watch?v=i_JOkHaCdzk
https://t2.fi/schedule/2024/
https://news.ycombinator.com/item?id=39778203

Impacted products

2 products

Vendor	Product	Version
openbsd	openbsd	Affected: 0 , < 7.4 (custom) cpe:2.3:o:openbsd:openbsd::::::::
freebsd	freebsd	Affected: 0 , < 14.0 (custom) cpe:2.3:o:freebsd:freebsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:17:58.456Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.signedness.org/t2.fi.2024/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.youtube.com/watch?v=i_JOkHaCdzk"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://t2.fi/schedule/2024/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=39778203"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "lessThan": "7.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "freebsd",
            "vendor": "freebsd",
            "versions": [
              {
                "lessThan": "14.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-29937",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-21T01:37:05.415426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:58:21.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-21T17:52:56.124Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.signedness.org/t2.fi.2024/"
        },
        {
          "url": "https://www.youtube.com/watch?v=i_JOkHaCdzk"
        },
        {
          "url": "https://t2.fi/schedule/2024/"
        },
        {
          "url": "https://news.ycombinator.com/item?id=39778203"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-29937",
    "datePublished": "2024-03-21T00:00:00.000Z",
    "dateReserved": "2024-03-21T00:00:00.000Z",
    "dateUpdated": "2025-03-13T15:58:21.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2026-103547 (GCVE-0-2026-103547)

Vulnerability from cvelistv5 – Published: 2026-09-30 19:40 – Updated: 2026-09-30 19:55

Summary

In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-30 19:55 UTC

CWE

CWE-863 - Incorrect Authorization

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://www.openbsd.org/errata79.html
https://github.com/openbsd/src/commit/4f3f58e83c2…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/c…
https://www.openbsd.org/errata78.html

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.8 , < errata 057 (custom) Affected: 7.9 , < errata 021 (custom) cpe:2.3:o:openbsd:openbsd:::::::: cpe:2.3:o:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-103547",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-30T19:55:41.738525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-30T19:55:54.044Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "repo": "https://github.com/openbsd/src",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "errata 057",
              "status": "affected",
              "version": "7.8",
              "versionType": "custom"
            },
            {
              "lessThan": "errata 021",
              "status": "affected",
              "version": "7.9",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "errata 057",
                  "versionStartIncluding": "7.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "errata 021",
                  "versionStartIncluding": "7.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP child process client file descriptor and LDAP message ID. After a connection closes, a later connection that reuses the same file descriptor and message ID can receive the earlier authentication result. A remote attacker who can reach ldapd can complete a Bind as another identity. A missing connection can also cause a NULL pointer dereference. (ldapd is not enabled by default.)"
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863 Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-30T19:40:53.200Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.openbsd.org/errata79.html"
        },
        {
          "url": "https://github.com/openbsd/src/commit/4f3f58e83c2a6d239c544236a9d4d76c74bbf960"
        },
        {
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.9/common/021_ldapd.patch.sig"
        },
        {
          "url": "https://www.openbsd.org/errata78.html"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-103547",
    "datePublished": "2026-09-30T19:40:53.200Z",
    "dateReserved": "2026-09-30T19:40:52.241Z",
    "dateUpdated": "2026-09-30T19:55:54.044Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56101 (GCVE-0-2026-56101)

Vulnerability from cvelistv5 – Published: 2026-09-08 16:00 – Updated: 2026-09-10 15:02 X_Open Source

Title

OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS

Summary

OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected.

Severity

6 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 13:49 UTC

CWE

CWE-697 - Incorrect Comparison

Assigner

VulnCheck mitre root Scorecard

References

3 references

URL	Tags
https://pop.argus-systems.ai/advisory/adv-209.html	technical-descriptionexploit
https://github.com/openbsd/src/commit/1ee99dfcc4d…	patch
https://www.vulncheck.com/advisories/openbsd-ieee…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , < 1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a (git)

Date Public

2026-07-15 00:00

Credits

Argus Systems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56101",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T13:49:14.964977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-10T15:02:16.176Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:github/openbsd/src",
          "product": "OpenBSD",
          "repo": "https://github.com/openbsd/src",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Argus Systems"
        }
      ],
      "datePublic": "2026-07-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80211/ieee80211_crypto_tkip.c that allows unauthenticated attackers within RF range to trigger denial of service by sending two malformed TKIP frames separated by more than 60 seconds. Attackers can exploit the reversed TKIP MIC failure countermeasure window check to deauthenticate all associated TKIP stations and block reassociation for up to 90 seconds, while within-window MIC failures that should engage countermeasures are silently discarded, leaving key-recovery attempts undetected."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-697",
              "description": "Incorrect Comparison",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T16:00:30.572Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "Argus Systems Advisory",
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://pop.argus-systems.ai/advisory/adv-209.html"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openbsd/src/commit/1ee99dfcc4ddc87afc6395d5d3094e9d2314fb5a"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openbsd-ieee80211-crypto-tkip-c-tkip-mic-countermeasure-logic-inversion-dos"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "OpenBSD ieee80211_crypto_tkip.c TKIP MIC Countermeasure Logic Inversion DoS",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56101",
    "datePublished": "2026-09-08T16:00:30.572Z",
    "dateReserved": "2026-06-18T19:15:10.649Z",
    "dateUpdated": "2026-09-10T15:02:16.176Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57589 (GCVE-0-2026-57589)

Vulnerability from cvelistv5 – Published: 2026-06-25 00:33 – Updated: 2026-06-26 03:55

Summary

sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 00:00 UTC

CWE

CWE-416 - Use After Free

Assigner

mitre mitre root Scorecard

References

2 references

URL	Tags
https://github.com/openbsd/src/commit/1957873d206…
https://openai.com/index/patch-the-planet/

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , ≤ 7.9 (custom) cpe:2.3:o:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57589",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-26T03:55:33.978Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThanOrEqual": "7.9",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "7.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416 Use After Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T00:33:04.749Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/openbsd/src/commit/1957873d2063db11dab780eca75b5e629d1e838d"
        },
        {
          "url": "https://openai.com/index/patch-the-planet/"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-57589",
    "datePublished": "2026-06-25T00:33:04.749Z",
    "dateReserved": "2026-06-25T00:33:04.330Z",
    "dateUpdated": "2026-06-26T03:55:33.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-56099 (GCVE-0-2026-56099)

Vulnerability from cvelistv5 – Published: 2026-06-18 19:29 – Updated: 2026-07-14 21:33 X_Open Source

Title

OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input

Summary

OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-23 20:44 UTC

CWE

CWE-125 - Out-of-bounds Read

Assigner

VulnCheck mitre root Scorecard

References

5 references

URL	Tags
https://pop.argus-systems.ai/advisory/adv-040.html	technical-descriptionexploit
https://github.com/openbsd/src/commit/6a23123ec05…	patch
https://www.vulncheck.com/advisories/openbsd-mpls…	third-party-advisory
http://www.openwall.com/lists/oss-security/2026/06/19/3
http://seclists.org/fulldisclosure/2026/Jun/17

Impacted products

1 product

Vendor	Product	Version
openbsd	src	Affected: 0 , < 6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd (git)

Date Public

2026-06-18 00:00

Credits

Argus Systems

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-06-21T07:37:24.961Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/06/19/3"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2026/Jun/17"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-56099",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-23T20:44:12.654787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-23T20:44:20.494Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "packageURL": "pkg:github/openbsd/src",
          "product": "src",
          "repo": "https://github.com/openbsd/src",
          "vendor": "openbsd",
          "versions": [
            {
              "lessThan": "6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Argus Systems"
        }
      ],
      "datePublic": "2026-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD before commit 6a23123 (2026-06-18) contains an out-of-bounds read vulnerability in the mpls_do_error function within sys/netmpls/mpls_input.c that allows remote attackers to disclose kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-125",
              "description": "Out-of-bounds Read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-14T21:33:59.892Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://pop.argus-systems.ai/advisory/adv-040.html"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/openbsd/src/commit/6a23123ec05f1eb29cfcaae0f3a468b2e1983cfd"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/openbsd-mpls-do-error-kernel-stack-memory-disclosure-via-mpls-input"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "tags": [
        "x_open-source"
      ],
      "title": "OpenBSD mpls_do_error Kernel Stack Memory Disclosure via MPLS Input",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-56099",
    "datePublished": "2026-06-18T19:29:08.271Z",
    "dateReserved": "2026-06-18T19:15:10.649Z",
    "dateUpdated": "2026-07-14T21:33:59.892Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55706 (GCVE-0-2026-55706)

Vulnerability from cvelistv5 – Published: 2026-06-17 00:53 – Updated: 2026-06-17 14:33

Summary

sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths.

Severity

5.8 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-17 14:32 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://blog.argus-systems.ai/blog/openbsd-pap-27…
https://www.openwall.com/lists/oss-security/2026/…
https://github.com/openbsd/src/commit/076e2b1c1fc…
https://blog.argus-systems.ai/blog/poc-001-pap-by…	exploit

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , < 076e2b1c1fc4ac0883a72d3544131ad5cee7adf8 (git) cpe:2.3:o:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55706",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-17T14:32:57.493186Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-17T14:33:01.050Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://blog.argus-systems.ai/blog/poc-001-pap-bypass.py"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "076e2b1c1fc4ac0883a72d3544131ad5cee7adf8",
              "status": "affected",
              "version": "0",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "076e2b1c1fc4ac0883a72d3544131ad5cee7adf8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "sppp_pap_input in sys/net/if_spppsubr.c in OpenBSD before 076e2b1 allows authentication bypass via certain zero values for lengths."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T00:53:23.246Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://blog.argus-systems.ai/blog/openbsd-pap-27-year-auth-bypass.html"
        },
        {
          "url": "https://www.openwall.com/lists/oss-security/2026/06/16/9"
        },
        {
          "url": "https://github.com/openbsd/src/commit/076e2b1c1fc4ac0883a72d3544131ad5cee7adf8"
        }
      ],
      "x_generator": {
        "engine": "CVE-Request-form 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-55706",
    "datePublished": "2026-06-17T00:53:23.246Z",
    "dateReserved": "2026-06-17T00:53:22.791Z",
    "dateUpdated": "2026-06-17T14:33:01.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-41285 (GCVE-0-2026-41285)

Vulnerability from cvelistv5 – Published: 2026-04-20 00:00 – Updated: 2026-04-21 13:27

Summary

In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an "nd_opt_len * 8 - 2" expression with no preceding check for whether nd_opt_len is zero.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-04-21 13:27 UTC

CWE

CWE-1284 - Improper Validation of Specified Quantity in Input

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
https://www.rfc-editor.org/rfc/rfc4861#section-4.6
https://github.com/openbsd/src/commit/086c5738bcd…
https://www.openbsd.org/errata78.html

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 0 , ≤ 7.8 (custom) cpe:2.3:a:openbsd:openbsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-41285",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-21T13:27:20.927005Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-21T13:27:42.310Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThanOrEqual": "7.8",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:openbsd:openbsd:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "7.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD through 7.8, the slaacd and rad daemons have an infinite loop when they receive a crafted ICMPv6 Neighbor Discovery (ND) option (over a local network) with length zero, because of an \"nd_opt_len * 8 - 2\" expression with no preceding check for whether nd_opt_len is zero."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1284",
              "description": "CWE-1284 Improper Validation of Specified Quantity in Input",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-20T23:27:57.468Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.rfc-editor.org/rfc/rfc4861#section-4.6"
        },
        {
          "url": "https://github.com/openbsd/src/commit/086c5738bcd3c203bcc08d024fcf983cb409115f"
        },
        {
          "url": "https://www.openbsd.org/errata78.html"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2026-41285",
    "datePublished": "2026-04-20T00:00:00.000Z",
    "dateReserved": "2026-04-20T00:00:00.000Z",
    "dateUpdated": "2026-04-21T13:27:42.310Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-30334 (GCVE-0-2025-30334)

Vulnerability from cvelistv5 – Published: 2025-03-20 20:39 – Updated: 2025-03-21 15:22

Title

OpenBSD wg(4) kernel crash

Summary

In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · cisa-cg (v2.0.3)

Decision recorded 2025-03-05 19:18 UTC

CWE

CWE-131 - Incorrect Calculation of Buffer Size

Assigner

cisa-cg CISA root Scorecard

References

3 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/c…
https://github.com/openbsd/src/commit/c0619985973…

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.6 , < 7.6 errata 006 (custom) Unaffected: 7.6 errata 008 Affected: 7.5 , < 7.5 errata 015 (custom) Unaffected: 7.5 errata 015

Date Public

2025-01-10 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-30334",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-21T15:21:31.344583Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-21T15:22:01.218Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.6 errata 006",
              "status": "affected",
              "version": "7.6",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.6 errata 008"
            },
            {
              "lessThan": "7.5 errata 015",
              "status": "affected",
              "version": "7.5",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.5 errata 015"
            }
          ]
        }
      ],
      "datePublic": "2025-01-10T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        },
        {
          "other": {
            "content": {
              "id": "CVE-2025-30334",
              "options": [
                {
                  "Exploitation": "none"
                },
                {
                  "Automatable": "no"
                },
                {
                  "Technical Impact": "partial"
                }
              ],
              "role": "CISA Coordinator",
              "timestamp": "2025-03-05T19:18:47.764235Z",
              "version": "2.0.3"
            },
            "type": "ssvc"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-131",
              "description": "CWE-131 Incorrect Calculation of Buffer Size",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-03-20T21:58:11.624Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/006_wg.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/015_wg.patch.sig"
        },
        {
          "name": "url",
          "url": "https://github.com/openbsd/src/commit/c06199859734d958552a581d72b4c0f910e68d7c"
        }
      ],
      "title": "OpenBSD wg(4) kernel crash"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2025-30334",
    "datePublished": "2025-03-20T20:39:16.232Z",
    "dateReserved": "2025-03-20T20:14:34.240Z",
    "dateUpdated": "2025-03-21T15:22:01.218Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11149 (GCVE-0-2024-11149)

Vulnerability from cvelistv5 – Published: 2024-12-06 01:56 – Updated: 2024-12-06 16:41

Title

OpenBSD vmm GDTR limits

Summary

In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs.

Severity

6.2 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:H/AU:N

7.9 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-06 14:11 UTC

CWE

CWE-noinfo Not enough information

Assigner

cisa-cg CISA root Scorecard

References

1 reference

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.4 , < 7.4 errata 014 (custom) Unaffected: 7.4 errata 014

Date Public

2024-02-23 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11149",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-06T14:11:42.541995Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-06T16:41:55.500Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.4 errata 014",
              "status": "affected",
              "version": "7.4",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.4 errata 014"
            }
          ]
        }
      ],
      "datePublic": "2024-02-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.4 before errata 014, vmm(4) did not restore GDTR limits properly on Intel (VMX) CPUs."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 6.2,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:H/AU:N",
            "version": "4.0"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-noinfo Not enough information",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-06T01:56:12.697Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/014_vmm.patch.sig"
        }
      ],
      "title": "OpenBSD vmm GDTR limits"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-11149",
    "datePublished": "2024-12-06T01:56:12.697Z",
    "dateReserved": "2024-11-12T15:39:38.790Z",
    "dateUpdated": "2024-12-06T16:41:55.500Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10933 (GCVE-0-2024-10933)

Vulnerability from cvelistv5 – Published: 2024-12-05 20:06 – Updated: 2024-12-05 20:40

Title

OpenBSD readdir directory traversal

Summary

In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any '/' in readdir name validation to avoid unexpected directory traversal on untrusted file systems.

Severity

4.1 (Medium)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-05 20:40 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/c…

Impacted products

1 product

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.5 , < 7.5 errata 009 (custom) Affected: 7.4 , < 7.4 errata 022 (custom) Unaffected: 7.5 errata 009 Unaffected: 7.4 errata 022

Date Public

2024-09-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10933",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-05T20:40:39.299892Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-05T20:40:58.356Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.5 errata 009",
              "status": "affected",
              "version": "7.5",
              "versionType": "custom"
            },
            {
              "lessThan": "7.4 errata 022",
              "status": "affected",
              "version": "7.4",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.5 errata 009"
            },
            {
              "status": "unaffected",
              "version": "7.4 errata 022"
            }
          ]
        }
      ],
      "datePublic": "2024-09-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.5 before errata 009 and OpenBSD 7.4 before errata 022, exclude any \u0027/\u0027 in readdir name validation to avoid unexpected directory traversal on untrusted file systems."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 4.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T20:06:23.001Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/022_readdir.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/009_readdir.patch.sig"
        }
      ],
      "title": "OpenBSD readdir directory traversal"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-10933",
    "datePublished": "2024-12-05T20:06:23.001Z",
    "dateReserved": "2024-11-06T18:12:15.857Z",
    "dateUpdated": "2024-12-05T20:40:58.356Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-11148 (GCVE-0-2024-11148)

Vulnerability from cvelistv5 – Published: 2024-12-05 19:50 – Updated: 2024-12-06 18:58

Title

OpenBSD httpd(8) null dereference

Summary

In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-12-06 18:57 UTC

CWE

CWE-476 - NULL Pointer Dereference

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/c…

Impacted products

2 products

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.4 , < 7.4 errata 006 (custom) Unaffected: 7.4 errata 006 Affected: 7.3 , < 7.3 errata 020 (custom) Unaffected: 7.3 errata 020
openbsd	openbsd	Affected: 7.4_errata006 Affected: 7.3_errata020 cpe:2.3:a:openbsd:openbsd:-:::::::*

Date Public

2023-11-21 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:openbsd:openbsd:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "status": "affected",
                "version": "7.4_errata006"
              },
              {
                "status": "affected",
                "version": "7.3_errata020"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11148",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-06T18:57:22.246744Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-06T18:58:45.147Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "lessThan": "7.4 errata 006",
              "status": "affected",
              "version": "7.4",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.4 errata 006"
            },
            {
              "lessThan": "7.3 errata 020",
              "status": "affected",
              "version": "7.3",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "7.3 errata 020"
            }
          ]
        }
      ],
      "datePublic": "2023-11-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.4 before errata 006 and OpenBSD 7.3 before errata 020, httpd(8) is vulnerable to a NULL dereference when handling a malformed fastcgi request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/AU:Y",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-476",
              "description": "CWE-476 NULL Pointer Dereference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-05T19:50:19.954Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/006_httpd.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.3/common/020_httpd.patch.sig"
        }
      ],
      "title": "OpenBSD httpd(8) null dereference"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-11148",
    "datePublished": "2024-12-05T19:50:19.954Z",
    "dateReserved": "2024-11-12T15:39:23.020Z",
    "dateUpdated": "2024-12-06T18:58:45.147Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-10934 (GCVE-0-2024-10934)

Vulnerability from cvelistv5 – Published: 2024-11-15 19:20 – Updated: 2025-10-02 14:09

Title

OpenBSD NFS double-free vulnerability

Summary

In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, avoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-15 19:46 UTC

CWE

CWE-415 - Double Free
CWE-457 - Use of Uninitialized Variable

Assigner

cisa-cg CISA root Scorecard

References

2 references

URL	Tags
https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/c…
https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/c…

Impacted products

2 products

Vendor	Product	Version
OpenBSD	OpenBSD	Affected: 7.5 Affected: 7.4
openbsd	openbsd	Affected: 7.5 , < 7.5_errata_008 (custom) Affected: 7.4 , < 7.4_errata_021 (custom) cpe:2.3:o:openbsd:openbsd::::::::

Date Public

2024-11-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "lessThan": "7.5_errata_008",
                "status": "affected",
                "version": "7.5",
                "versionType": "custom"
              },
              {
                "lessThan": "7.4_errata_021",
                "status": "affected",
                "version": "7.4",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-10934",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-15T19:46:59.490027Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-15T19:47:11.376Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "OpenBSD",
          "vendor": "OpenBSD",
          "versions": [
            {
              "status": "affected",
              "version": "7.5"
            },
            {
              "status": "affected",
              "version": "7.4"
            }
          ]
        }
      ],
      "datePublic": "2024-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "In OpenBSD 7.5 before errata 008 and OpenBSD 7.4 before errata 021, \navoid possible mbuf double free in NFS client and server implementation, do not use uninitialized variable in error handling of NFS server."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y",
            "version": "4.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-415",
              "description": "CWE-415 Double Free",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-457",
              "description": "CWE-457 Use of Uninitialized Variable",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-02T14:09:00.828Z",
        "orgId": "9119a7d8-5eab-497f-8521-727c672e3725",
        "shortName": "cisa-cg"
      },
      "references": [
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/008_nfs.patch.sig"
        },
        {
          "name": "url",
          "url": "https://ftp.openbsd.org/pub/OpenBSD/patches/7.4/common/021_nfs.patch.sig"
        }
      ],
      "title": "OpenBSD NFS double-free vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9119a7d8-5eab-497f-8521-727c672e3725",
    "assignerShortName": "cisa-cg",
    "cveId": "CVE-2024-10934",
    "datePublished": "2024-11-15T19:20:02.231Z",
    "dateReserved": "2024-11-06T18:12:18.387Z",
    "dateUpdated": "2025-10-02T14:09:00.828Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-43688 (GCVE-0-2024-43688)

Vulnerability from cvelistv5 – Published: 2024-08-20 00:00 – Updated: 2024-08-26 13:23

Summary

cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring.

Severity

7.3 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-26 13:17 UTC

CWE

n/a
CWE-787 - Out-of-bounds Write

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
https://www.supernetworks.org/advisories/CVE-2024…
https://github.com/vixie/cron/commit/9cc8ab1087bb…
https://www.supernetworks.org/CVE-2024-43688/open…

Impacted products

3 products

Vendor	Product	Version
vixie	cron	Affected: 0 , < 9cc8ab1 (custom) cpe:2.3:a:vixie:cron::::::::
openbsd	openbsd	Affected: 7.4 cpe:2.3:o:openbsd:openbsd:7.4:::::::*
openbsd	openbsd	Affected: 7.5 cpe:2.3:o:openbsd:openbsd:7.5:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:vixie:cron:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cron",
            "vendor": "vixie",
            "versions": [
              {
                "lessThan": "9cc8ab1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:7.4:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "status": "affected",
                "version": "7.4"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:7.5:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "status": "affected",
                "version": "7.5"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-43688",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-26T13:17:12.595187Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-787",
                "description": "CWE-787 Out-of-bounds Write",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-26T13:23:36.277Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. NOTE: this issue was introduced during a May 2023 refactoring."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-26T06:03:33.171Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.supernetworks.org/advisories/CVE-2024-43688-openbsd-cron-heap-underflow.txt"
        },
        {
          "url": "https://github.com/vixie/cron/commit/9cc8ab1087bb9ab861dd5595c41200683c9f6712"
        },
        {
          "url": "https://www.supernetworks.org/CVE-2024-43688/openbsd-cron-heap-underflow.txt"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-43688",
    "datePublished": "2024-08-20T00:00:00.000Z",
    "dateReserved": "2024-08-14T00:00:00.000Z",
    "dateUpdated": "2024-08-26T13:23:36.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-35000 (GCVE-0-2021-35000)

Vulnerability from cvelistv5 – Published: 2024-05-07 22:54 – Updated: 2024-09-18 18:27

Title

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability

Summary

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-16112.

Severity

3.3 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-08 14:50 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

zdi mitre root Scorecard

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

1 product

Vendor	Product	Version
OpenBSD	Kernel	Affected: OpenBSD 6.9

Date Public

2022-01-06 13:24

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-35000",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-08T14:50:29.518755Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:12:34.540Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:26:55.763Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-22-012",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-012/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kernel",
          "vendor": "OpenBSD",
          "versions": [
            {
              "status": "affected",
              "version": "OpenBSD 6.9"
            }
          ]
        }
      ],
      "dateAssigned": "2021-06-30T13:56:51.764Z",
      "datePublic": "2022-01-06T13:24:06.686Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.\n. Was ZDI-CAN-16112."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-18T18:27:57.926Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-22-012",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-012/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Reno Robert of Trend Micro Zero Day Initiative"
      },
      "title": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2021-35000",
    "datePublished": "2024-05-07T22:54:52.586Z",
    "dateReserved": "2021-06-17T19:27:05.669Z",
    "dateUpdated": "2024-09-18T18:27:57.926Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-34999 (GCVE-0-2021-34999)

Vulnerability from cvelistv5 – Published: 2024-05-07 22:54 – Updated: 2024-09-18 18:19

Title

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability

Summary

OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. . Was ZDI-CAN-14540.

Severity

3.8 (Low)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-08 15:31 UTC

CWE

CWE-908 - Use of Uninitialized Resource

Assigner

zdi mitre root Scorecard

References

1 reference

URL	Tags
https://www.zerodayinitiative.com/advisories/ZDI-…	x_research-advisory

Impacted products

2 products

Vendor	Product	Version
OpenBSD	Kernel	Affected: OpenBSD 6.9
openbsd	openbsd	Affected: 0 , < 7.0 (custom) cpe:2.3:o:openbsd:openbsd::::::::

Date Public

2022-01-13 13:45

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:26:55.938Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ZDI-22-073",
            "tags": [
              "x_research-advisory",
              "x_transferred"
            ],
            "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-073/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "lessThan": "7.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-34999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-08T15:31:35.373260Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-21T21:11:13.017Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Kernel",
          "vendor": "OpenBSD",
          "versions": [
            {
              "status": "affected",
              "version": "OpenBSD 6.9"
            }
          ]
        }
      ],
      "dateAssigned": "2021-06-30T13:56:51.762Z",
      "datePublic": "2022-01-13T13:45:04.504Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of OpenBSD Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.\n\nThe specific flaw exists within the implementation of multicast routing. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel.\n. Was ZDI-CAN-14540."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 3.8,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-908",
              "description": "CWE-908: Use of Uninitialized Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-18T18:19:31.677Z",
        "orgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
        "shortName": "zdi"
      },
      "references": [
        {
          "name": "ZDI-22-073",
          "tags": [
            "x_research-advisory"
          ],
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-22-073/"
        }
      ],
      "source": {
        "lang": "en",
        "value": "Reno Robert of Trend Micro Zero Day Initiative"
      },
      "title": "OpenBSD Kernel Multicast Routing Uninitialized Memory Information Disclosure Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99f1926a-a320-47d8-bbb5-42feb611262e",
    "assignerShortName": "zdi",
    "cveId": "CVE-2021-34999",
    "datePublished": "2024-05-07T22:54:51.785Z",
    "dateReserved": "2021-06-17T19:27:05.669Z",
    "dateUpdated": "2024-09-18T18:19:31.677Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-29937 (GCVE-0-2024-29937)

Vulnerability from cvelistv5 – Published: 2024-03-21 00:00 – Updated: 2025-03-13 15:58

Summary

NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-04-21 01:37 UTC

CWE

n/a
CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

mitre mitre root Scorecard

References

4 references

URL	Tags
https://www.signedness.org/t2.fi.2024/
https://www.youtube.com/watch?v=i_JOkHaCdzk
https://t2.fi/schedule/2024/
https://news.ycombinator.com/item?id=39778203

Impacted products

2 products

Vendor	Product	Version
openbsd	openbsd	Affected: 0 , < 7.4 (custom) cpe:2.3:o:openbsd:openbsd::::::::
freebsd	freebsd	Affected: 0 , < 14.0 (custom) cpe:2.3:o:freebsd:freebsd::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T01:17:58.456Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.signedness.org/t2.fi.2024/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.youtube.com/watch?v=i_JOkHaCdzk"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://t2.fi/schedule/2024/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://news.ycombinator.com/item?id=39778203"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:openbsd:openbsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "openbsd",
            "vendor": "openbsd",
            "versions": [
              {
                "lessThan": "7.4",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:freebsd:freebsd:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "freebsd",
            "vendor": "freebsd",
            "versions": [
              {
                "lessThan": "14.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-29937",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-04-21T01:37:05.415426Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-94",
                "description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-13T15:58:21.660Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary code via a bug that is unrelated to memory corruption."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-03-21T17:52:56.124Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://www.signedness.org/t2.fi.2024/"
        },
        {
          "url": "https://www.youtube.com/watch?v=i_JOkHaCdzk"
        },
        {
          "url": "https://t2.fi/schedule/2024/"
        },
        {
          "url": "https://news.ycombinator.com/item?id=39778203"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-29937",
    "datePublished": "2024-03-21T00:00:00.000Z",
    "dateReserved": "2024-03-21T00:00:00.000Z",
    "dateUpdated": "2025-03-13T15:58:21.660Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Find a vulnerability

Search criteria

426 vulnerabilities found for OpenBSD by OpenBSD

CVE-2026-103547 (GCVE-0-2026-103547)

CVE-2026-56101 (GCVE-0-2026-56101)

CVE-2026-57589 (GCVE-0-2026-57589)

CVE-2026-56099 (GCVE-0-2026-56099)

CVE-2026-55706 (GCVE-0-2026-55706)

CVE-2026-41285 (GCVE-0-2026-41285)

CVE-2025-30334 (GCVE-0-2025-30334)

CVE-2024-11149 (GCVE-0-2024-11149)

CVE-2024-11148 (GCVE-0-2024-11148)

CVE-2024-10933 (GCVE-0-2024-10933)

CVE-2024-10934 (GCVE-0-2024-10934)

CVE-2024-43688 (GCVE-0-2024-43688)

CVE-2021-35000 (GCVE-0-2021-35000)

CVE-2021-34999 (GCVE-0-2021-34999)

CVE-2024-29937 (GCVE-0-2024-29937)

CVE-2026-103547 (GCVE-0-2026-103547)

CVE-2026-56101 (GCVE-0-2026-56101)

CVE-2026-57589 (GCVE-0-2026-57589)

CVE-2026-56099 (GCVE-0-2026-56099)

CVE-2026-55706 (GCVE-0-2026-55706)

CVE-2026-41285 (GCVE-0-2026-41285)

CVE-2025-30334 (GCVE-0-2025-30334)

CVE-2024-11149 (GCVE-0-2024-11149)

CVE-2024-10933 (GCVE-0-2024-10933)

CVE-2024-11148 (GCVE-0-2024-11148)

CVE-2024-10934 (GCVE-0-2024-10934)

CVE-2024-43688 (GCVE-0-2024-43688)

CVE-2021-35000 (GCVE-0-2021-35000)

CVE-2021-34999 (GCVE-0-2021-34999)

CVE-2024-29937 (GCVE-0-2024-29937)