{"id":"UBUNTU-CVE-2026-43958","details":"A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.","modified":"2026-06-05T23:45:16.183536805Z","published":"2026-06-01T19:16:00Z","upstream":["CVE-2026-43958"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2026-43958"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2026-43958"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-43958"}],"affected":[{"package":{"name":"rrdtool","ecosystem":"Ubuntu:14.04:LTS","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=trusty"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.7-2ubuntu2","1.4.7-2ubuntu3","1.4.7-2ubuntu4","1.4.7-2ubuntu5"],"ecosystem_specific":{"binaries":[{"binary_version":"1.4.7-2ubuntu5","binary_name":"liblua5.2-rrd0"},{"binary_version":"1.4.7-2ubuntu5","binary_name":"librrd-ruby"},{"binary_name":"librrd-ruby1.9.1","binary_version":"1.4.7-2ubuntu5"},{"binary_version":"1.4.7-2ubuntu5","binary_name":"librrd4"},{"binary_name":"librrdp-perl","binary_version":"1.4.7-2ubuntu5"},{"binary_version":"1.4.7-2ubuntu5","binary_name":"librrds-perl"},{"binary_name":"python-rrdtool","binary_version":"1.4.7-2ubuntu5"},{"binary_version":"1.4.7-2ubuntu5","binary_name":"rrdcached"},{"binary_version":"1.4.7-2ubuntu5","binary_name":"rrdtool"},{"binary_name":"rrdtool-tcl","binary_version":"1.4.7-2ubuntu5"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}},{"package":{"name":"rrdtool","ecosystem":"Ubuntu:16.04:LTS","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.4-5","1.5.5-1","1.5.5-3","1.5.5-3build1","1.5.5-3build2","1.5.5-4"],"ecosystem_specific":{"binaries":[{"binary_name":"liblua5.1-rrd0","binary_version":"1.5.5-4"},{"binary_name":"librrd4","binary_version":"1.5.5-4"},{"binary_version":"1.5.5-4","binary_name":"librrdp-perl"},{"binary_name":"librrds-perl","binary_version":"1.5.5-4"},{"binary_name":"lua-rrd","binary_version":"1.5.5-4"},{"binary_version":"1.5.5-4","binary_name":"python-rrdtool"},{"binary_name":"rrdcached","binary_version":"1.5.5-4"},{"binary_name":"rrdtool","binary_version":"1.5.5-4"},{"binary_name":"rrdtool-tcl","binary_version":"1.5.5-4"},{"binary_name":"ruby-rrd","binary_version":"1.5.5-4"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}},{"package":{"name":"rrdtool","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1ubuntu2","1.7.0-0ubuntu4","1.7.0-1","1.7.0-1build1"],"ecosystem_specific":{"binaries":[{"binary_name":"librrd8","binary_version":"1.7.0-1build1"},{"binary_name":"librrdp-perl","binary_version":"1.7.0-1build1"},{"binary_name":"librrds-perl","binary_version":"1.7.0-1build1"},{"binary_version":"1.7.0-1build1","binary_name":"lua-rrd"},{"binary_version":"1.7.0-1build1","binary_name":"python-rrdtool"},{"binary_name":"python3-rrdtool","binary_version":"1.7.0-1build1"},{"binary_name":"rrdcached","binary_version":"1.7.0-1build1"},{"binary_name":"rrdtool","binary_version":"1.7.0-1build1"},{"binary_name":"rrdtool-tcl","binary_version":"1.7.0-1build1"},{"binary_version":"1.7.0-1build1","binary_name":"ruby-rrd"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}},{"package":{"name":"rrdtool","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.1-2","1.7.2-1ubuntu2","1.7.2-3","1.7.2-3build1","1.7.2-3build2"],"ecosystem_specific":{"binaries":[{"binary_version":"1.7.2-3build2","binary_name":"librrd8"},{"binary_version":"1.7.2-3build2","binary_name":"librrdp-perl"},{"binary_name":"librrds-perl","binary_version":"1.7.2-3build2"},{"binary_version":"1.7.2-3build2","binary_name":"lua-rrd"},{"binary_version":"1.7.2-3build2","binary_name":"python3-rrdtool"},{"binary_name":"rrdcached","binary_version":"1.7.2-3build2"},{"binary_name":"rrdtool","binary_version":"1.7.2-3build2"},{"binary_version":"1.7.2-3build2","binary_name":"rrdtool-tcl"},{"binary_name":"ruby-rrd","binary_version":"1.7.2-3build2"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}},{"package":{"name":"rrdtool","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-3build6","1.7.2-3ubuntu1","1.7.2-3ubuntu2","1.7.2-3ubuntu5","1.7.2-3ubuntu6"],"ecosystem_specific":{"binaries":[{"binary_version":"1.7.2-3ubuntu6","binary_name":"librrd8"},{"binary_version":"1.7.2-3ubuntu6","binary_name":"librrdp-perl"},{"binary_name":"librrds-perl","binary_version":"1.7.2-3ubuntu6"},{"binary_version":"1.7.2-3ubuntu6","binary_name":"lua-rrd"},{"binary_name":"python3-rrdtool","binary_version":"1.7.2-3ubuntu6"},{"binary_name":"rrdcached","binary_version":"1.7.2-3ubuntu6"},{"binary_version":"1.7.2-3ubuntu6","binary_name":"rrdtool"},{"binary_name":"rrdtool-tcl","binary_version":"1.7.2-3ubuntu6"},{"binary_name":"ruby-rrd","binary_version":"1.7.2-3ubuntu6"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}},{"package":{"name":"rrdtool","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=noble"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-4ubuntu5","1.7.2-4ubuntu6","1.7.2-4ubuntu8","1.7.2-4.1ubuntu2","1.7.2-4.1ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_name":"librrd8t64","binary_version":"1.7.2-4.1ubuntu3"},{"binary_name":"librrdp-perl","binary_version":"1.7.2-4.1ubuntu3"},{"binary_name":"librrds-perl","binary_version":"1.7.2-4.1ubuntu3"},{"binary_name":"lua-rrd","binary_version":"1.7.2-4.1ubuntu3"},{"binary_name":"python3-rrdtool","binary_version":"1.7.2-4.1ubuntu3"},{"binary_name":"rrdcached","binary_version":"1.7.2-4.1ubuntu3"},{"binary_name":"rrdtool","binary_version":"1.7.2-4.1ubuntu3"},{"binary_name":"rrdtool-tcl","binary_version":"1.7.2-4.1ubuntu3"},{"binary_version":"1.7.2-4.1ubuntu3","binary_name":"ruby-rrd"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}},{"package":{"name":"rrdtool","ecosystem":"Ubuntu:25.10","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=questing"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-4.2ubuntu2","1.7.2-4.2ubuntu3"],"ecosystem_specific":{"binaries":[{"binary_version":"1.7.2-4.2ubuntu3","binary_name":"librrd8t64"},{"binary_name":"librrdp-perl","binary_version":"1.7.2-4.2ubuntu3"},{"binary_name":"librrds-perl","binary_version":"1.7.2-4.2ubuntu3"},{"binary_name":"lua-rrd","binary_version":"1.7.2-4.2ubuntu3"},{"binary_name":"python3-rrdtool","binary_version":"1.7.2-4.2ubuntu3"},{"binary_name":"rrdcached","binary_version":"1.7.2-4.2ubuntu3"},{"binary_name":"rrdtool","binary_version":"1.7.2-4.2ubuntu3"},{"binary_version":"1.7.2-4.2ubuntu3","binary_name":"rrdtool-tcl"},{"binary_version":"1.7.2-4.2ubuntu3","binary_name":"ruby-rrd"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}},{"package":{"name":"rrdtool","ecosystem":"Ubuntu:26.04:LTS","purl":"pkg:deb/ubuntu/rrdtool?arch=source&distro=resolute"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.7.2-4.2ubuntu3","1.7.2-4.2ubuntu4","1.9.0-2","1.9.0-2build1"],"ecosystem_specific":{"binaries":[{"binary_name":"librrd8t64","binary_version":"1.9.0-2build1"},{"binary_name":"librrdp-perl","binary_version":"1.9.0-2build1"},{"binary_version":"1.9.0-2build1","binary_name":"librrds-perl"},{"binary_name":"lua-rrd","binary_version":"1.9.0-2build1"},{"binary_name":"python3-rrdtool","binary_version":"1.9.0-2build1"},{"binary_name":"rrdcached","binary_version":"1.9.0-2build1"},{"binary_version":"1.9.0-2build1","binary_name":"rrdtool"},{"binary_name":"rrdtool-tcl","binary_version":"1.9.0-2build1"},{"binary_version":"1.9.0-2build1","binary_name":"ruby-rrd"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-43958.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},{"type":"Ubuntu","score":"medium"}]}