Improper input validation in chicken
Priority LOW 31CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Chicken before 4.8.0 does not properly handle NUL bytes in certain strings, which allows an attacker to conduct "poisoned NUL byte attack."
Why it matters now
EPSS 0.01277 70th percentileScored 2026-11-07
Fix Fixed chicken (chicken): 4.8.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| chicken | chicken | before 4.8.0 | 4.8.0 | Patch available | CNA |
- chicken Vendorchicken Affected before 4.8.0 Fixed in 4.8.0 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:call-cc:chicken:*:*:*:*:*:*:*:* | before 4.8.0 | Vulnerable | chicken |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:call-cc:chicken:*:*:*:*:*:*:*:* Versions before 4.8.0 Vulnerable ·chicken
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · CNA chicken (chicken) Fixed in 4.8.0
Timeline
- 2026-10-02 Threatist record created from CVE-2012-6123
- 2026-10-03 Alias added: GHSA-448r-5hhg-h92c
References
More Chicken vulnerabilities
- TI-2022-22220 egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during… CVSS 3.1CRITICAL 9.8
- TI-2014-05188 Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute… CVSS 3.1CRITICAL 9.8
- TI-2016-05868 The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size… CVSS 3.0CRITICAL 9.8
- TI-2012-05089 Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions. CVSS 3.1CRITICAL 9.8
- TI-2013-01796 OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. CVSS 3.1HIGH 8.8
- TI-2013-01846 Buffer overflow in chicken CVSS 3.1HIGH 8.8
Sources
- CVE-2012-6123 · CVE Program
- CVE-2012-6123 · NVD
- FIRST EPSS
- GHSA-448r-5hhg-h92c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences