DEBIAN-CVE-2026-32854

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-32854
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32854.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-32854
Upstream
  • CVE-2026-32854
Published
2026-03-24T18:16:09.423Z
Modified
2026-04-06T04:00:15.746340Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee) contain null pointer dereference vulnerabilities in the HTTP proxy handlers within httpProcessInput() in httpd.c that allow remote attackers to cause a denial of service by sending specially crafted HTTP requests. Attackers can exploit missing validation of strchr() return values in the CONNECT and GET proxy handling paths to trigger null pointer dereferences and crash the server when httpd and proxy features are enabled.

References

Affected packages

Debian:11 / libvncserver

Package

Name
libvncserver
Purl
pkg:deb/debian/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.13+dfsg-2
0.9.13+dfsg-2+deb11u1
0.9.13+dfsg-3
0.9.13+dfsg-4
0.9.13+dfsg-5
0.9.14+dfsg-1
0.9.15+dfsg-1
0.9.15+dfsg-2
0.9.15+dfsg-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32854.json"

Debian:12 / libvncserver

Package

Name
libvncserver
Purl
pkg:deb/debian/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.14+dfsg-1
0.9.15+dfsg-1
0.9.15+dfsg-2
0.9.15+dfsg-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32854.json"

Debian:13 / libvncserver

Package

Name
libvncserver
Purl
pkg:deb/debian/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

0.*
0.9.15+dfsg-1
0.9.15+dfsg-2
0.9.15+dfsg-3

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32854.json"

Debian:14 / libvncserver

Package

Name
libvncserver
Purl
pkg:deb/debian/libvncserver?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0.9.15+dfsg-3

Affected versions

0.*
0.9.15+dfsg-1
0.9.15+dfsg-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-32854.json"