Read the docs
TI-2025-23798 Aliases CVE-2025-32743GHSA-r8hx-vf7j-v5q3

In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an…

Priority HIGH 74CWE-392Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This allows attackers to cause a denial of service (application crash) or possibly execute arbitrary code, because those lookup values lead to incorrect length calculations and incorrect memcpy operations.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00526 44th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ConnManConnManup to 1.44—No fix listedCNA
  • ConnMan VendorConnMan Affected up to 1.44 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-32743
  2. 2026-10-03 Alias added: GHSA-r8hx-vf7j-v5q3

References

Other 2

  • TI-2012-02059 The loopback plug-in in ConnMan before 0.85 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 10.0
  • TI-2012-02058 ConnMan before 0.85 does not ensure that netlink messages originate from the kernel… CVSS 2.0HIGH 7.8
  • TI-2026-79981 Stack-based buffer overflow in ConnMan DHCPv6 handling CVSS 3.1HIGH 7.6
  • TI-2012-02060 Integer overflow in the dhcpv6_get_option function in gdhcp/client.c in ConnMan before… CVSS 2.0MEDIUM 5.0
  • TI-2025-23446 In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR… CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences