Read the docs
TI-2020-01863 Aliases CVE-2020-1939GHSA-cxvf-qrfm-r86m

NULL pointer dereference in Apache NuttX

Priority MEDIUM 47CWE-476Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-476.

Summary

The Apache NuttX (Incubating) project provides an optional separate "apps" repository which contains various optional components and example programs. One of these, ftpd, had a NULL pointer dereference bug. The NuttX RTOS itself is not affected. Users of the optional apps repository are affected only if they have enabled ftpd. Versions 6.15 to 8.2 are affected.

Why it matters now

EPSS 0.02559 85th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Apache NuttX (incubating)Apache NuttX (incubating) 6.15 to 8.2—No fix listedCNA
  • Apache NuttX (incubating) Vendor— Affected Apache NuttX (incubating) 6.15 to 8.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:*6.15 – 8.2VulnerableApache
  • cpe:2.3:a:apache:nuttx:*:*:*:*:*:*:*:* Versions 6.15 – 8.2 Vulnerable ·Apache

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1939
  2. 2026-10-03 Alias added: GHSA-cxvf-qrfm-r86m

References

Patch 1

  • TI-2025-24548 Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE Vulnerabilities. CVSS 3.1CRITICAL 9.8
  • TI-2025-30293 Apache NuttX RTOS: examples/xmlrpc: Fix calls buffers size. CVSS 3.1CRITICAL 9.8
  • TI-2025-30292 Apache NuttX RTOS: tools/bdf-converter.: tools/bdf-converter: Fix loop termination condition. CVSS 3.1CRITICAL 9.8
  • TI-2021-08260 malloc, realloc and memalign implementations are vulnerable to integer wrap-arounds CVSS 3.1CRITICAL 9.8
  • TI-2020-13277 Apache NuttX (incubating) Out of Bound Write from invalid fragmentation offset value specified in the IP header CVSS 3.1CRITICAL 9.8
  • TI-2020-13276 Apache NuttX (incubating) Out of Bound Write from invalid TCP Urgent length CVSS 3.1CRITICAL 9.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences