MediumFix available
zabbix — security advisory
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.
- Products
- zabbix
- Affected versions
- 1:6.0.14+dfsg-1, 1:6.0.23+dfsg-1, 1:6.0.23+dfsg-1~bpo12+1, 1:6.0.24+dfsg-1, 1:6.0.25+dfsg-1, 1:6.0.29+dfsg-1, 1:7.0.0+dfsg-1, 1:7.0.0+dfsg-2, 1:7.0.0+dfsg-2~bpo12+1, 1:7.0.1+dfsg-1, 1:7.0.1+dfsg-1~bpo12+1, 1:7.0.10+dfsg-1, 1:7.0.10+dfsg-2, 1:7.0.2+dfsg-1, 1:7.0.2+dfsg-1~bpo12+1, 1:7.0.22+dfsg-1, 1:7.0.22+dfsg-1.1, 1:7.0.22+dfsg-1~bpo13+1, 1:7.0.22+dfsg-1~deb13u1, 1:7.0.27+dfsg-1, 1:7.0.29+dfsg-1, 1:7.0.29+dfsg-2, 1:7.0.29+dfsg-2~bpo13+1, 1:7.0.3+dfsg-1, 1:7.0.5+dfsg-1, 1:7.0.5+dfsg-1~bpo12+1, 1:7.0.6+dfsg-1, 1:7.0.9+dfsg-1, 1:7.0.9+dfsg-1~bpo12+1
- Fixed versions
- 1:7.0.29+dfsg-1
- CVEs
- CVE-2026-59787
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 03:40 UTC · Revision 1
Source evidence
The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.
osv:DEBIAN-CVE-2026-59787
zabbix
Fixed versions: Not specified
zabbix
Fixed versions: Not specified
zabbix
Fixed versions: 1:7.0.29+dfsg-1
Complete source record
{
"id": "fe616f45ced5869cb7ffe68cd99da759ccb1115c89bc65d0e90e616445414936",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-59787",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-59787",
"summary": "The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone able to send SNMP traps can inject a record targeting another host, resulting in a loss of integrity.",
"evidence": "osv:DEBIAN-CVE-2026-59787",
"products": [
{
"name": {
"value": "zabbix",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:6.0.14+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:6.0.23+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:6.0.23+dfsg-1~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "1:6.0.24+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:6.0.25+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:6.0.29+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.0+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.0+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.0+dfsg-2~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.1+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.1+dfsg-1~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.10+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.10+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.2+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.2+dfsg-1~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.22+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.22+dfsg-1.1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.22+dfsg-1~bpo13+1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.22+dfsg-1~deb13u1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.27+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.29+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.29+dfsg-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.29+dfsg-2~bpo13+1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.3+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.5+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.5+dfsg-1~bpo12+1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.6+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.9+dfsg-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:7.0.9+dfsg-1~bpo12+1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "zabbix",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:7.0.10+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.22+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.22+dfsg-1.1",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.22+dfsg-1~bpo13+1",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.22+dfsg-1~deb13u1",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.27+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.29+dfsg-1",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.29+dfsg-2",
"evidence": "/affected/1/versions"
},
{
"value": "1:7.0.29+dfsg-2~bpo13+1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "zabbix",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:7.0.29+dfsg-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": [
{
"value": "1:7.0.10+dfsg-2",
"evidence": "/affected/2/versions"
},
{
"value": "1:7.0.22+dfsg-1",
"evidence": "/affected/2/versions"
},
{
"value": "1:7.0.22+dfsg-1.1",
"evidence": "/affected/2/versions"
},
{
"value": "1:7.0.22+dfsg-1~bpo13+1",
"evidence": "/affected/2/versions"
},
{
"value": "1:7.0.22+dfsg-1~deb13u1",
"evidence": "/affected/2/versions"
},
{
"value": "1:7.0.27+dfsg-1",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2026-59787",
"aliases": [
"DEBIAN-CVE-2026-59787"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1:6.0.14+dfsg-1",
"1:6.0.23+dfsg-1",
"1:6.0.23+dfsg-1~bpo12+1",
"1:6.0.24+dfsg-1",
"1:6.0.25+dfsg-1",
"1:6.0.29+dfsg-1",
"1:7.0.0+dfsg-1",
"1:7.0.0+dfsg-2",
"1:7.0.0+dfsg-2~bpo12+1",
"1:7.0.1+dfsg-1",
"1:7.0.1+dfsg-1~bpo12+1",
"1:7.0.10+dfsg-1",
"1:7.0.10+dfsg-2",
"1:7.0.2+dfsg-1",
"1:7.0.2+dfsg-1~bpo12+1",
"1:7.0.22+dfsg-1",
"1:7.0.22+dfsg-1.1",
"1:7.0.22+dfsg-1~bpo13+1",
"1:7.0.22+dfsg-1~deb13u1",
"1:7.0.27+dfsg-1",
"1:7.0.29+dfsg-1",
"1:7.0.29+dfsg-2",
"1:7.0.29+dfsg-2~bpo13+1",
"1:7.0.3+dfsg-1",
"1:7.0.5+dfsg-1",
"1:7.0.5+dfsg-1~bpo12+1",
"1:7.0.6+dfsg-1",
"1:7.0.9+dfsg-1",
"1:7.0.9+dfsg-1~bpo12+1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-59787.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1:7.0.10+dfsg-2",
"1:7.0.22+dfsg-1",
"1:7.0.22+dfsg-1.1",
"1:7.0.22+dfsg-1~bpo13+1",
"1:7.0.22+dfsg-1~deb13u1",
"1:7.0.27+dfsg-1",
"1:7.0.29+dfsg-1",
"1:7.0.29+dfsg-2",
"1:7.0.29+dfsg-2~bpo13+1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-59787.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:7.0.29+dfsg-1"
}
]
}
],
"package": {
"name": "zabbix",
"purl": "pkg:deb/debian/zabbix?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1:7.0.10+dfsg-2",
"1:7.0.22+dfsg-1",
"1:7.0.22+dfsg-1.1",
"1:7.0.22+dfsg-1~bpo13+1",
"1:7.0.22+dfsg-1~deb13u1",
"1:7.0.27+dfsg-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-59787.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-07T09:47:32.483576470Z",
"provider": "osv",
"upstream": [
"CVE-2026-59787"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-59787"
]
},
"related_cves": [
{
"value": "CVE-2026-59787",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 94656,
"published_at": "2026-10-05T11:16:59.953+00:00"
}