CVE-2026-43958

EUVD-2026-33726
A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 3%
Debian logo
Debian Releases
Debian Product
Codename
rrdtool
bookworm
postponed
bullseye
postponed
forky
vulnerable
sid
vulnerable
trixie
no-dsa
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
python3-rrdtool
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
rrdtool
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
rrdtool-devel
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
rrdtool-doc
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
rrdtool-lua
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
rrdtool-perl
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
rrdtool-ruby
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
rrdtool-tcl
RHEL 8
0:1.7.0-17.el8_10
fixed
RHEL 9
0:1.7.2-22.el9_8
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
python3-rrdtool
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
python3-rrdtool-debuginfo
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-debuginfo
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-debugsource
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-devel
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-doc
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-lua
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-lua-debuginfo
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-perl
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-perl-debuginfo
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-tcl
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
rrdtool-tcl-debuginfo
Amazon Linux 2023
0:1.7.2-16.amzn2023.0.4
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
rrdtool
Azure Linux 3.0
0:1.8.0-3.azl3
fixed
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2026:33731
https://access.redhat.com/errata/RHSA-2026:34155
https://access.redhat.com/errata/RHSA-2026:34156
https://access.redhat.com/security/cve/CVE-2026-43958
https://bugzilla.redhat.com/show_bug.cgi?id=2460932