CVE-2016-9686

5.3 mediumEPSS 1.3%

The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.

Severity

CVSS 3.0

5.3 medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2017-02-08
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

puppet:puppet_enterprise

References

https://puppet.com/security/cve/cve-2016-9686
https://puppet.com/security/cve/cve-2016-9686

Check your stack JSON