CVE-2017-7401

7.5 highEPSS 4.0%

High (7.5) in collectd collectd. EPSS 4.0% chance of exploitation in the next 30 days.

Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet.

Severity

CVSS 3.0

7.5 high

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 4.0% chance of exploitation in the next 30 days; higher than 90% of CVEs (scores of 2026-10-31)
CWE: CWE-835
Published: 2017-04-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

collectd:collectd

References

http://www.securityfocus.com/bid/97321
https://access.redhat.com/errata/RHSA-2017:1285
https://access.redhat.com/errata/RHSA-2017:1787
https://access.redhat.com/errata/RHSA-2018:2615
https://github.com/collectd/collectd/issues/2174

Check your stack JSON