{"id":"CVE-2017-7401","details":"Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with \"SecurityLevel None\" and with empty \"AuthFile\" options) via a crafted UDP packet.","modified":"2026-07-08T12:28:17.785394Z","published":"2017-04-03T14:59:00.200Z","related":["SUSE-SU-2017:1365-1","openSUSE-SU-2024:10691-1"],"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/97321"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1285"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2017:1787"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2018:2615"},{"type":"FIX","url":"https://github.com/collectd/collectd/issues/2174"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/collectd/collectd","events":[{"introduced":"0"},{"last_affected":"0c157068b398f336b6478cb24fa05243b49fcda4"}],"database_specific":{"cpe":"cpe:2.3:a:collectd:collectd:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"last_affected":"5.7.1"}],"source":"CPE_RANGE"}}],"versions":["collectd-5.7.0","collectd-5.7.1","collectd-5.5.0","collectd-5.2.0","collectd-5.3.0","collectd-5.1.0","collectd-5.0.0-beta1","collectd-5.0.0-beta0","collectd-4.10.0","collectd-4.6.0","collectd-4.3.0","collectd-4.3.0beta1","collectd-4.3.0beta0","collectd-4.2.0","collectd-4.1.1","collectd-4.1.0","collectd-4.0.0","collectd-4.0.0-rc10","collectd-4.0.0-rc8","collectd-4.0.0-rc7","collectd-4.0.0-rc6","collectd-4.0.0-rc4","collectd-3.10.0","collectd-3.7.0","collectd-2.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7401.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}