Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

collectd can freeze from crafted UDP packet

CVE-2017-7401 · published 9 years ago
Summary

Versions of collectd up to 5.7.1 can stop responding if they are set to no security and an attacker sends a specially formed UDP message. This leaves the monitoring service unavailable until it is restarted. Update to a newer collectd release or enable authentication to prevent the issue.

What to do
  • Update debian collectd to version 5.7.2-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian collectd < 5.7.2-1
Fix: upgrade to 5.7.2-1
Debian:12 debian collectd < 5.7.2-1
Fix: upgrade to 5.7.2-1
Debian:13 debian collectd < 5.7.2-1
Fix: upgrade to 5.7.2-1
– collectd collectd <= 5.7.1
cpe:2.3:a:collectd:collectd:*:*:*:*:*:*:*:*
Original advisory text
Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of...
Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Type
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
Timeline
Published3 Apr 2017
Updated23 Oct 2026
First seen26 Aug 2026
Sources
DEBIAN-CVE-2017-7401 · OSV
CVE-2017-7401 · NVD
Track software like this
Free during beta