DEBIAN-CVE-2026-38821
A heap-based buffer overflow vulnerability exists in openNDS before 11.0.0 that allows an unauthenticated attacker on the captive portal network to crash the openNDS daemon (denial of service) and potentially achieve remote code execution. This is in http_microhttpd.c.
DEBIAN-CVE-2026-38821
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-38821
opennds
Source reference: /affected/0/package/name
- Affected versions
- 10.2.0+dfsg-1
Source reference:
/affected/0/versions10.3.0+dfsg-0.1Source reference:
/affected/0/versions10.3.1+dfsg-1Source reference:
/affected/0/versions9.10.0-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
opennds
Source reference: /affected/1/package/name
- Affected versions
- 10.3.1+dfsg-1
Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "opennds",
"purl": "pkg:deb/debian/opennds?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"10.2.0+dfsg-1",
"10.3.0+dfsg-0.1",
"10.3.1+dfsg-1",
"9.10.0-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-38821.json"
},
"ecosystem_specific": {
"urgency": "end-of-life"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "opennds",
"purl": "pkg:deb/debian/opennds?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"10.3.1+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-38821.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]- Related CVEs
- CVE-2026-38821
Source reference:
/upstream
Publisher severity
high
Source reference: /severity/0/score
- Event
- #81904 · Revision 1
- Added to Heist Feed
- Publisher date