Read the docs
TI-2017-02374 Aliases CVE-2017-3158GHSA-3vv3-585q-wv6x

Race condition in Apache Guacamole

Priority LOW 38CWE-362Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

A race condition in Guacamole's terminal emulator in versions 0.9.5 through 0.9.10-incubating could allow writes of blocks of printed data to overlap. Such overlapping writes could cause packet data to be misread as the packet length, resulting in the remaining data being written beyond the end of a statically-allocated buffer.

Why it matters now

EPSS 0.01221 68th percentileScored 2026-11-07
Fix Fixed org.apache.guacamole:guacamole-common (Maven): 0.9.11-incubating

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache GuacamoleApache Guacamole 0.9.5 to 0.9.10-incubating—No fix listedCNA
—org.apache.guacamole:guacamole-common (Maven)0.9.5 to before 0.9.11-incubating0.9.11-incubatingPatch availableGHSA-3vv3-585q-wv6x
  • Apache Guacamole VendorApache Affected Apache Guacamole 0.9.5 to 0.9.10-incubating Fixed in — No fix listed CNA
  • org.apache.guacamole:guacamole-common (Maven) Vendor— Affected 0.9.5 to before 0.9.11-incubating Fixed in 0.9.11-incubating Patch available GHSA-3vv3-585q-wv6x

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:guacamole:*:*:*:*:*:*:*:*up to 0.9.9VulnerableApache
cpe:2.3:a:apache:guacamole:0.9.10-incubating:*:*:*:*:*:*:*0.9.10-incubatingVulnerableApache
  • cpe:2.3:a:apache:guacamole:*:*:*:*:*:*:*:* Versions up to 0.9.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:guacamole:0.9.10-incubating:*:*:*:*:*:*:* Versions 0.9.10-incubating Vulnerable ·Apache

Remediation

  • Fix · GHSA-3vv3-585q-wv6x org.apache.guacamole:guacamole-common (Maven) Fixed in 0.9.11-incubating Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-3158
  2. 2026-10-03 Alias added: GHSA-3vv3-585q-wv6x

References

Advisory 1

Other 2

  • TI-2019-14123 SQLite 3.30.1 mishandles certain SELECT statements with a nonexistent VIEW, leading to an application crash. CVSS 3.1HIGH 7.5
  • TI-2023-23512 Apache Guacamole: Integer overflow in handling of VNC image buffers CVSS 3.1HIGH 8.8
  • TI-2021-19751 Improper validation of SAML responses CVSS 3.1HIGH 8.8
  • TI-2023-14404 Apache Guacamole: Use-after-free in handling of RDP audio input buffer CVSS 3.1HIGH 8.1
  • TI-2018-01241 Prior to 1.0.0, Apache Guacamole used a cookie for client-side storage of the user's… CVSS 3.0HIGH 7.5
  • TI-2024-23239 Apache Guacamole: Improper input validation of console codes CVSS 3.1HIGH 7.5
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences