{"id":"CVE-2026-63201","aliases":[],"cve":{"records":[{"id":"CVE-2026-63201","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-15T22:19:06.905Z","published":"2026-10-30T22:03:18.551Z","modified":"2026-10-30T22:03:18.551Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T22:03:18.551Z"}],"references":[{"url":"https://github.com/CESNET/netopeer2/security/advisories/GHSA-25gm-4x89-7r2q","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/CESNET/netopeer2/commit/e98beb2d4d8cc82875208bccb8e1348a8e9e95b3","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/CESNET/netopeer2/releases/tag/2.8.21","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-134","description":"CWE-134: Use of Externally-Controlled Format String","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"netopeer2-server logging has format string vulnerability via subtree filter","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.","score":7.1,"severity":"high","published":"2026-10-30T22:03:18.551Z","modified":"2026-10-30T22:03:18.551Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"CESNET","name":"netopeer2","platforms":[],"versions":[{"version":"< 2.8.21","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-63201"}],"remediation":[],"references":["https://github.com/CESNET/netopeer2/security/advisories/GHSA-25gm-4x89-7r2q","https://github.com/CESNET/netopeer2/commit/e98beb2d4d8cc82875208bccb8e1348a8e9e95b3","https://github.com/CESNET/netopeer2/releases/tag/2.8.21"],"sources":[{"name":"CVE","id":"CVE-2026-63201","modified":"2026-10-30T22:03:18.551Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-63201"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1}],"sourceAffected":[],"observedAt":"2026-10-30T22:48:37.600Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T16:20:31.233Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T23:25:31.511Z","attemptedAt":"2026-10-30T23:25:31.511Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T23:25:31.641Z","attemptedAt":"2026-10-30T23:25:31.641Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T23:25:31.259Z","attemptedAt":"2026-10-30T23:25:31.259Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T23:25:31.139Z","attemptedAt":"2026-10-30T23:25:31.139Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-63201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63201","modified":"2026-10-30T22:16:58.637","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-30T23:25:31.511Z"}],"aiSummary":null}