Gnu Inetutils vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Gnu Inetutils: 4 record(s), with affected versions and fixes.
cpe:2.3:a:gnu:inetutils

CVE-2026-32772 Medium · 4.7 CWE-669 Mar 16, 2026

Incorrect Resource Transfer Between Spheres in Gnu Inetutils

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

CVE-2026-32746 Critical · 9.8 Public exploit CWE-120 Mar 13, 2026

Classic Buffer Overflow in Gnu Inetutils

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

CVE-2026-28372 High · 7.8 CWE-829 Feb 27, 2026

telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited…

telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIRECTORY environment variable, and requires an unprivileged local user to create a login.noauth file.

CVE-2026-24061 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-88 Jan 21, 2026

GNU InetUtils Argument Injection Vulnerability

telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.