Read the docs
TI-2026-83429 Aliases CVE-2026-63201

Format string flaw in netopeer2-server logging allows remote crash

Priority LOW 32CWE-134Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-134 and the CVSS impact.

Summary

Netopeer2 before 2.8.21 contains a format string flaw (CWE-134) in its logging code, where an externally controlled subtree filter is passed as a format string. A low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter containing format specifiers. The crash was confirmed on version 2.8.7, but reliable remote code execution was not confirmed.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00432 37th percentileScored 2026-11-07
Fix Fixed netopeer2 (CESNET): 2.8.21

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CESNETnetopeer2before 2.8.212.8.21Patch availableCNA
  • netopeer2 VendorCESNET Affected before 2.8.21 Fixed in 2.8.21 Patch available CNA

Remediation

Upgrade netopeer2 to version 2.8.21, which repository comparisons verify as fixed. The advisory identifies 2.8.8 as patched, but no public 2.8.8 tag was located, so the status of that version remains unresolved.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA netopeer2 (CESNET) Fixed in 2.8.21

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-63201
  2. 2026-10-31 Affected versions changed · Red Hat
  3. 2026-10-31 CVSS score added · Red Hat
  4. 2026-11-01 Priority changed: MEDIUM → LOW
  5. 2026-11-02 CISA SSVC decision points changed

References

Other 3

  • TI-2026-32573 libyang: lyb_read_string() integer overflow → heap buffer overflow CVSS 3.1HIGH 7.5
  • TI-2023-11820 libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via… CVSS 3.1HIGH 7.5
  • TI-2026-79264 Uninitialized pointer free in libyang NETCONF RPC parser CVSS 4.0MEDIUM 6.0
  • TI-2019-13946 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
  • TI-2019-13945 Stack-based buffer overflow in Red Hat libyang CVSS 3.1CRITICAL 9.8
  • TI-2019-11637 The proxystatistics module before 3.1.0 for SimpleSAMLphp allows SQL Injection in lib/Auth/Process/DatabaseCommand.php. CVSS 3.0CRITICAL 9.8
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences