CVE-2008-2956
** DISPUTED ** Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers...
Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
Exploit likelihood
What each source reports
NVD Score used
Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
- Record
CVE-2008-2956- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
- Record
CVE-2008-2956- Updated
- 2026-11-02
EUVDEUVD-2008-2946 No score
Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
- Record
EUVD-2008-2946- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f69j-274h-2m7w No score
** DISPUTED ** Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers...
** DISPUTED ** Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
- Record
GHSA-f69j-274h-2m7w- Updated
- 2026-11-02
OSV No score
Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
- Record
CVE-2008-2956- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-2956 No score
Memory leak in Pidgin 2.0.0, and possibly other versions, allows remote attackers to cause a denial of service (memory consumption) via malformed XML documents. NOTE: this issue has been disputed by the upstream vendor, who states: "I was never able to identify a scenario under which a problem occurred and the original reporter wasn't able to supply any sort of reproduction details."
- Record
DEBIAN-CVE-2008-2956- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pidginDebian:12 |
All versions, plus listed versions 2.14.12-12.14.12-1.12.14.12-1.1~exp12.14.13-12.14.13-22.14.14-1 |
None known |
pidginDebian:13 |
All versions, plus listed versions 2.14.14-1 |
None known |
pidginDebian:14 |
All versions, plus listed versions 2.14.14-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-2956 is a medium vulnerability (CVSS 5.0) in Pidgin, published July 1, 2008. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 2.00%, the 80th percentile.