Read the docs
TI-2005-01812 Aliases CVE-2005-1911GHSA-g92w-h4gx-4m3r

The fetchnews NNTP client in leafnode 1.11.2 and earlier can hang while waiting for input…

Priority LOW 25Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The fetchnews NNTP client in leafnode 1.11.2 and earlier can hang while waiting for input that never arrives, which allows remote NNTP servers to cause a denial of service (news loss).

Why it matters now

EPSS 0.01138 66th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:leafnode:leafnode:1.9.19:*:*:*:*:*:*:*1.9.19VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.20:*:*:*:*:*:*:*1.9.20VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.21:*:*:*:*:*:*:*1.9.21VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.22:*:*:*:*:*:*:*1.9.22VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.23:*:*:*:*:*:*:*1.9.23VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.24:*:*:*:*:*:*:*1.9.24VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.25:*:*:*:*:*:*:*1.9.25VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.26:*:*:*:*:*:*:*1.9.26VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.27:*:*:*:*:*:*:*1.9.27VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.28:*:*:*:*:*:*:*1.9.28VulnerableLeafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.19:*:*:*:*:*:*:* Versions 1.9.19 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.20:*:*:*:*:*:*:* Versions 1.9.20 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.21:*:*:*:*:*:*:* Versions 1.9.21 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.22:*:*:*:*:*:*:* Versions 1.9.22 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.23:*:*:*:*:*:*:* Versions 1.9.23 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.24:*:*:*:*:*:*:* Versions 1.9.24 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.25:*:*:*:*:*:*:* Versions 1.9.25 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.26:*:*:*:*:*:*:* Versions 1.9.26 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.27:*:*:*:*:*:*:* Versions 1.9.27 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.28:*:*:*:*:*:*:* Versions 1.9.28 Vulnerable ·Leafnode
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:leafnode:leafnode:1.9.29:*:*:*:*:*:*:*1.9.29VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.30:*:*:*:*:*:*:*1.9.30VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.31:*:*:*:*:*:*:*1.9.31VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.32:*:*:*:*:*:*:*1.9.32VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.33:*:*:*:*:*:*:*1.9.33VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.34:*:*:*:*:*:*:*1.9.34VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.35:*:*:*:*:*:*:*1.9.35VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.36:*:*:*:*:*:*:*1.9.36VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.37:*:*:*:*:*:*:*1.9.37VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.38:*:*:*:*:*:*:*1.9.38VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.39:*:*:*:*:*:*:*1.9.39VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.40:*:*:*:*:*:*:*1.9.40VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.41:*:*:*:*:*:*:*1.9.41VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.42:*:*:*:*:*:*:*1.9.42VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.43:*:*:*:*:*:*:*1.9.43VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.44:*:*:*:*:*:*:*1.9.44VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.45:*:*:*:*:*:*:*1.9.45VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.46:*:*:*:*:*:*:*1.9.46VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.47:*:*:*:*:*:*:*1.9.47VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.48:*:*:*:*:*:*:*1.9.48VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.52:*:*:*:*:*:*:*1.9.52VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.9.53:*:*:*:*:*:*:*1.9.53VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableLeafnode
cpe:2.3:a:leafnode:leafnode:1.11.1:*:*:*:*:*:*:*1.11.1VulnerableLeafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.29:*:*:*:*:*:*:* Versions 1.9.29 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.30:*:*:*:*:*:*:* Versions 1.9.30 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.31:*:*:*:*:*:*:* Versions 1.9.31 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.32:*:*:*:*:*:*:* Versions 1.9.32 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.33:*:*:*:*:*:*:* Versions 1.9.33 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.34:*:*:*:*:*:*:* Versions 1.9.34 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.35:*:*:*:*:*:*:* Versions 1.9.35 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.36:*:*:*:*:*:*:* Versions 1.9.36 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.37:*:*:*:*:*:*:* Versions 1.9.37 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.38:*:*:*:*:*:*:* Versions 1.9.38 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.39:*:*:*:*:*:*:* Versions 1.9.39 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.40:*:*:*:*:*:*:* Versions 1.9.40 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.41:*:*:*:*:*:*:* Versions 1.9.41 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.42:*:*:*:*:*:*:* Versions 1.9.42 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.43:*:*:*:*:*:*:* Versions 1.9.43 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.44:*:*:*:*:*:*:* Versions 1.9.44 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.45:*:*:*:*:*:*:* Versions 1.9.45 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.46:*:*:*:*:*:*:* Versions 1.9.46 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.47:*:*:*:*:*:*:* Versions 1.9.47 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.48:*:*:*:*:*:*:* Versions 1.9.48 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.52:*:*:*:*:*:*:* Versions 1.9.52 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.9.53:*:*:*:*:*:*:* Versions 1.9.53 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Leafnode
  • cpe:2.3:a:leafnode:leafnode:1.11.1:*:*:*:*:*:*:* Versions 1.11.1 Vulnerable ·Leafnode

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2005-1911
  2. 2026-10-03 Alias added: GHSA-g92w-h4gx-4m3r

References

Advisory 1

  • TI-2003-00687 The fetchnews NNTP client in leafnode 1.9.3 to 1.9.41 allows remote attackers to cause a… CVSS 2.0MEDIUM 5.0
  • TI-2002-01582 The leafnode server in leafnode 1.9.20 to 1.9.29 allows remote attackers to cause a… CVSS 2.0MEDIUM 5.0
  • TI-2005-01375 fetchnews in leafnode 1.9.48 to 1.11.1 allows remote NNTP servers to cause a denial of… CVSS 2.0MEDIUM 5.0
  • TI-2004-01941 fetchnews in leafnode 1.9.47 and earlier allows remote attackers to cause a denial of… CVSS 2.0MEDIUM 5.0

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences