Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-13575: Genivia gSOAP 2.8.107 can crash from crafted request

CVE-2020-13575 · published 5 years ago

Summary

The gSOAP library version 2.8.107 may stop working if it receives a specially formed SOAP message. An attacker could send such a request over HTTP and cause the service to become unavailable. Update the library to a newer version or apply the vendor’s patch to prevent the crash.

What to do

Update debian gsoap to version 2.8.104-3.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	gsoap	< 2.8.104-3 Fix: upgrade to 2.8.104-3
Debian:13	debian	gsoap	< 2.8.104-3 Fix: upgrade to 2.8.104-3
Debian:14	debian	gsoap	< 2.8.104-3 Fix: upgrade to 2.8.104-3
–	genivia	gsoap	2.8.107 `cpe:2.3:a:genivia:gsoap:2.8.107:::::::*`
–	fedoraproject	fedora	33 34 `cpe:2.3:o:fedoraproject:fedora:33:::::::*`

Original advisory text

A denial-of-service vulnerability exists in the WS-Addressing plugin functionality of Genivia gSOAP 2.8.107. A specially crafted SOAP request can lead to denial of service. An attacker can send an ...

References

https://security-tracker.debian.org/tracker/CVE-2020-13575 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/02/msg00015.html
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1186 Exploit Technical Description Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

2% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published10 Feb 2021

Updated29 Oct 2026

First seen11 Sep 2026

Sources

DEBIAN-CVE-2020-13575 · OSV

CVE-2020-13575 · NVD

Track software like this

Free during beta