The peel_netstring function in cl_netstring.c in the heartbeat subsystem in High-Availability Linux before 1.2.5, and 2.0 before 2.0.7, allows remote attackers to cause a denial of service (crash) via the length parameter in a heartbeat message.
Product
high availability linux project heartbeat vulnerabilities
2 published CVES affecting high availability linux project heartbeat, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 2
- Critical
- 0
- High
- 0
- Medium
- 1
- Low
- 1
- Unscored
- 0
- CISA KEV
- 0
Latest high availability linux project heartbeat CVEs
Newest publication first
-
MediumCVSS 5.0 EPSS 13.6%
-
LowCVSS 2.1 EPSS 0.36%
High Availability Linux Project Heartbeat 1.2.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.