Read the docs
TI-2020-09601 Aliases CVE-2020-11937GHSA-fcfw-r6pj-x447

Resource exhaustion vulnerability in whoopsie

Priority LOW 25CWE-400Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.

Why it matters now

EPSS 0.00468 40th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed whoopsie (Canonical): 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5, 0.2.69ubuntu0.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Canonicalwhoopsie0.2.52 to before 0.2.52.5ubuntu0.5; 0.2.62 to before 0.2.62ubuntu0.5; 0.2.69 to before 0.2.69ubuntu0.10.2.52.5ubuntu0.5, 0.2.62ubuntu0.5, 0.2.69ubuntu0.1Patch availableCNA
  • whoopsie VendorCanonical Affected 0.2.52 to before 0.2.52.5ubuntu0.5; 0.2.62 to before 0.2.62ubuntu0.5; 0.2.69 to before 0.2.69ubuntu0.1 Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5, 0.2.69ubuntu0.1 Patch available CNA

CPE configurations NVD · 30

CPEVersionsRoleVendor
cpe:2.3:a:canonical:whoopsie:0.2.66:*:*:*:*:*:*:*0.2.66VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.67:*:*:*:*:*:*:*0.2.67VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.68:*:*:*:*:*:*:*0.2.68VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.69:*:*:*:*:*:*:*0.2.69VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*20.04Running onCanonical
cpe:2.3:a:canonical:whoopsie:0.2.49:*:*:*:*:*:*:*0.2.49VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.50:*:*:*:*:*:*:*0.2.50VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.51:*:*:*:*:*:*:*0.2.51VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52:*:*:*:*:*:*:*0.2.52VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.1:*:*:*:*:*:*:*0.2.52.1VulnerableCanonical
  • cpe:2.3:a:canonical:whoopsie:0.2.66:*:*:*:*:*:*:* Versions 0.2.66 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.67:*:*:*:*:*:*:* Versions 0.2.67 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.68:*:*:*:*:*:*:* Versions 0.2.68 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.69:*:*:*:*:*:*:* Versions 0.2.69 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:* Versions 20.04 Running on ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.49:*:*:*:*:*:*:* Versions 0.2.49 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.50:*:*:*:*:*:*:* Versions 0.2.50 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.51:*:*:*:*:*:*:* Versions 0.2.51 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52:*:*:*:*:*:*:* Versions 0.2.52 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.1:*:*:*:*:*:*:* Versions 0.2.52.1 Vulnerable ·Canonical
Show 20 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:canonical:whoopsie:0.2.52.2:*:*:*:*:*:*:*0.2.52.2VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.3:*:*:*:*:*:*:*0.2.52.3VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.4:*:*:*:*:*:*:*0.2.52.4VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.5:*:*:*:*:*:*:*0.2.52.5VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.1:*:*:*:*:*:*:*0.2.52.5ubuntu0.1VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.2:*:*:*:*:*:*:*0.2.52.5ubuntu0.2VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.3:*:*:*:*:*:*:*0.2.52.5ubuntu0.3VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.4:*:*:*:*:*:*:*0.2.52.5ubuntu0.4VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04Running onCanonical
cpe:2.3:a:canonical:whoopsie:0.2.58:*:*:*:*:*:*:*0.2.58VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.59:*:*:*:*:*:*:*0.2.59VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.59build1:*:*:*:*:*:*:*0.2.59build1VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.60:*:*:*:*:*:*:*0.2.60VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.61:*:*:*:*:*:*:*0.2.61VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.62:*:*:*:*:*:*:*0.2.62VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.1:*:*:*:*:*:*:*0.2.62ubuntu0.1VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.2:*:*:*:*:*:*:*0.2.62ubuntu0.2VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.3:*:*:*:*:*:*:*0.2.62ubuntu0.3VulnerableCanonical
cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.4:*:*:*:*:*:*:*0.2.62ubuntu0.4VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04Running onCanonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.2:*:*:*:*:*:*:* Versions 0.2.52.2 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.3:*:*:*:*:*:*:* Versions 0.2.52.3 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.4:*:*:*:*:*:*:* Versions 0.2.52.4 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.5:*:*:*:*:*:*:* Versions 0.2.52.5 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.1:*:*:*:*:*:*:* Versions 0.2.52.5ubuntu0.1 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.2:*:*:*:*:*:*:* Versions 0.2.52.5ubuntu0.2 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.3:*:*:*:*:*:*:* Versions 0.2.52.5ubuntu0.3 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.52.5ubuntu0.4:*:*:*:*:*:*:* Versions 0.2.52.5ubuntu0.4 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Running on ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.58:*:*:*:*:*:*:* Versions 0.2.58 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.59:*:*:*:*:*:*:* Versions 0.2.59 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.59build1:*:*:*:*:*:*:* Versions 0.2.59build1 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.60:*:*:*:*:*:*:* Versions 0.2.60 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.61:*:*:*:*:*:*:* Versions 0.2.61 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.62:*:*:*:*:*:*:* Versions 0.2.62 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.1:*:*:*:*:*:*:* Versions 0.2.62ubuntu0.1 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.2:*:*:*:*:*:*:* Versions 0.2.62ubuntu0.2 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.3:*:*:*:*:*:*:* Versions 0.2.62ubuntu0.3 Vulnerable ·Canonical
  • cpe:2.3:a:canonical:whoopsie:0.2.62ubuntu0.4:*:*:*:*:*:*:* Versions 0.2.62ubuntu0.4 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Running on ·Canonical

Remediation

  • Fix · CNA whoopsie (Canonical) Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5, 0.2.69ubuntu0.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-11937
  2. 2026-10-03 Alias added: GHSA-fcfw-r6pj-x447

References

Exploit 2

Advisory 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences