Multiple stack-based buffer overflows in http.c in OpenConnect before 4.08 allow remote VPN gateways to cause a denial of service (application crash) via a long (1) hostname, (2) path, or (3) cookie list in a response.
2013-02-24T19:55:01.017
2025-04-11T00:51:21.963
Deferred
CVSSv2: 5.0 (MEDIUM)
AV:N/AC:L/Au:N/C:N/I:N/A:P
10.0
2.9
| Type | Vendor | Product | Version/Range | Vulnerable? |
|---|---|---|---|---|
| Application | infradead | openconnect | ≤ 4.07 | Yes |
| Application | infradead | openconnect | 1.00 | Yes |
| Application | infradead | openconnect | 1.10 | Yes |
| Application | infradead | openconnect | 1.20 | Yes |
| Application | infradead | openconnect | 1.30 | Yes |
| Application | infradead | openconnect | 1.40 | Yes |
| Application | infradead | openconnect | 2.00 | Yes |
| Application | infradead | openconnect | 2.01 | Yes |
| Application | infradead | openconnect | 2.10 | Yes |
| Application | infradead | openconnect | 2.11 | Yes |
| Application | infradead | openconnect | 2.12 | Yes |
| Application | infradead | openconnect | 2.20 | Yes |
| Application | infradead | openconnect | 2.21 | Yes |
| Application | infradead | openconnect | 2.22 | Yes |
| Application | infradead | openconnect | 2.23 | Yes |
| Application | infradead | openconnect | 2.24 | Yes |
| Application | infradead | openconnect | 2.25 | Yes |
| Application | infradead | openconnect | 2.26 | Yes |
| Application | infradead | openconnect | 3.00 | Yes |
| Application | infradead | openconnect | 3.01 | Yes |
| Application | infradead | openconnect | 3.02 | Yes |
| Application | infradead | openconnect | 3.11 | Yes |
| Application | infradead | openconnect | 3.12 | Yes |
| Application | infradead | openconnect | 3.13 | Yes |
| Application | infradead | openconnect | 3.14 | Yes |
| Application | infradead | openconnect | 3.15 | Yes |
| Application | infradead | openconnect | 3.16 | Yes |
| Application | infradead | openconnect | 3.17 | Yes |
| Application | infradead | openconnect | 3.18 | Yes |
| Application | infradead | openconnect | 3.19 | Yes |
| Application | infradead | openconnect | 3.20 | Yes |
| Application | infradead | openconnect | 3.99 | Yes |
| Application | infradead | openconnect | 4.00 | Yes |
| Application | infradead | openconnect | 4.01 | Yes |
| Application | infradead | openconnect | 4.02 | Yes |
| Application | infradead | openconnect | 4.03 | Yes |
| Application | infradead | openconnect | 4.04 | Yes |
| Application | infradead | openconnect | 4.05 | Yes |
| Application | infradead | openconnect | 4.06 | Yes |