CVE-2008-2469

Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2...

10.0 HighPublic exploitFix available

CVE-2008-2469 is a high vulnerability (CVSS 10.0) in Libspf Libspf2, published October 20, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 22.2%, the 97th percentile. Fixed in libspf2 1.2.9-1.

Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2 before 1.2.8 allows remote attackers to execute arbitrary code via a long DNS TXT record with a modified length field.

Exploit likelihood

22.2%Down 20.6 points since Feb 4, 2022

What each source reports

NVD Score used 10.0

Record: CVE-2008-2469
CVSS 2.0: 10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2008-2469
Updated: 2026-11-02

EUVDEUVD-2008-2464 No score

Record: EUVD-2008-2464
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jc7w-hj86-2rr5 No score

Heap-based buffer overflow in the SPF_dns_resolv_lookup function in Spf_dns_resolv.c in libspf2...

Record: GHSA-jc7w-hj86-2rr5
Weakness: CWE-119
Updated: 2026-11-02

OSV No score

Record: CVE-2008-2469
Updated: 2026-11-02

OSVDEBIAN-CVE-2008-2469 No score

Record: DEBIAN-CVE-2008-2469
Updated: 2026-11-02

Affected products

libspf libspf2

Affected packages

Affected packages
Package	Affected	Fixed
`libspf2` Debian:12	before 1.2.9-1	1.2.9-1
`libspf2` Debian:13	before 1.2.9-1	1.2.9-1
`libspf2` Debian:14	before 1.2.9-1	1.2.9-1
`libspf2` Debian:4.0	before 1.2.5-4+etch1, plus listed versions 1.2.5-4	1.2.5-4+etch1
`libspf2` Debian:5.0	before 1.2.5.dfsg-5+lenny1	1.2.5.dfsg-5+lenny1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	LibSPF2 < 1.2.8 - DNS TXT Record Parsing Bug Heap Overflow (PoC)	2008-10-22

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

References

Show 15 moreShow less