Inetutils (Gnu) - vulnerabilities (CVEs)

8 CVEs, 0 in the last 30 days, 25 known versions, newest CVE from 2026-03-16. Vendor: Gnu.

CVEs of Inetutils

• CVE-2026-32772 - CVSS 4.7 (medium), 2026-03-16: telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
• CVE-2026-32746 - CVSS 9.8 (critical), 2026-03-13: telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check…
• CVE-2026-28372 - CVSS 7.8 (high), 2026-02-27: telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1)…
• CVE-2026-24061 - CVSS 9.8 (critical), 2026-01-21: telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
• CVE-2023-40303 - CVSS 7.8 (high), 2023-08-14: GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and…
• CVE-2022-39028 - CVSS 7.5 (high), 2022-08-30: telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a…
• CVE-2021-40491 - CVSS 6.5 (medium), 2021-09-03: The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is…
• CVE-2011-4862 - CVSS 10 (critical), 2011-12-25: Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal…