Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Leafnode can freeze when receiving empty news article

CVE-2004-2068 · published 21 years ago
Summary

Leafnode versions 1.9.47 and earlier may stop responding if they get a news post that lacks required header information. This can cause the service to hang and become unavailable. Upgrade to a newer version of Leafnode or apply the vendor’s patch to prevent the freeze.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
leafnode leafnode 1.9.25
1.9.26
1.9.27
1.9.28
1.9.29
1.9.30
1.9.31
1.9.32
1.9.33
1.9.34
1.9.35
1.9.36
11 more version ranges
cpe:2.3:a:leafnode:leafnode:1.9.25:*:*:*:*:*:*:*
Original advisory text
fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service (process hang) via an empty NNTP news article with missing mandatory headers.
fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of service (process hang) via an empty NNTP news article with missing mandatory headers.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
2% chance of attack within 30 days
Timeline
Published31 Dec 2004
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2004-2068 · NVD
Track software like this
Free during beta