CVE-2008-4609
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4)...
CVE-2008-4609 is a high vulnerability (CVSS 7.1) in Bsd, published October 20, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 32.4%, the 98th percentile. Fixed in kernel 5.10.78.1-1.
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
Exploit likelihood
What each source reports
NVD Score used
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- Record
CVE-2008-4609- CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:N/I:N/A:C - Weakness
- CWE-16
- Updated
- 2026-11-02
CVE List No score
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- Record
CVE-2008-4609- Updated
- 2026-11-02
EUVDEUVD-2008-4589 No score
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- Record
EUVD-2008-4589- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vf4j-pjcc-qf79 No score
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4)...
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- Record
GHSA-vf4j-pjcc-qf79- Updated
- 2026-11-02
OSVAZL-6513 No score
CVE-2008-4609 affecting package kernel for versions less than 5.10.78.1-1
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- Record
AZL-6513- Updated
- 2026-11-02
OSV No score
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- Record
CVE-2008-4609- Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2008-4609 No score
The TCP implementation in (1) Linux, (2) platforms based on BSD Unix, (3) Microsoft Windows, (4) Cisco products, and probably other operating systems allows remote attackers to cause a denial of service (connection queue exhaustion) via multiple vectors that manipulate information in the TCP state table, as demonstrated by sockstress.
- Record
DEBIAN-CVE-2008-4609- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2008-4609 No score
CVE-2008-4609 in linux - Patched by Root
Root has patched CVE-2008-4609 in the linux package for Root:Debian:11. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-11-CVE-2008-4609- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2008-4609 No score
CVE-2008-4609 in linux - Patched by Root
Root has patched CVE-2008-4609 in the linux package for Root:Debian:12. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-12-CVE-2008-4609- Updated
- 2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2008-4609 No score
CVE-2008-4609 in linux - Patched by Root
Root has patched CVE-2008-4609 in the linux package for Root:Debian:13. Multiple fixed versions available.
- Record
ROOT-OS-DEBIAN-13-CVE-2008-4609- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kernelAzure Linux:2 |
before 5.10.78.1-1 | 5.10.78.1-1 |
linuxDebian:12 |
All versions, plus listed versions 6.1.106-16.1.106-26.1.106-36.1.112-16.1.115-1 Show 45 moreShow less6.1.119-16.1.123-16.1.124-16.1.128-16.1.129-16.1.133-16.1.135-16.1.137-16.1.139-16.1.140-16.1.147-16.1.148-16.1.153-16.1.158-16.1.159-16.1.162-16.1.164-16.1.170-16.1.170-26.1.170-36.1.172-16.1.174-16.1.176-16.1.177-16.1.180-16.1.187-16.1.190-16.1.27-16.1.37-16.1.38-16.1.38-26.1.38-2~bpo11+16.1.38-36.1.38-46.1.38-4~bpo11+16.1.52-16.1.55-16.1.55-1~bpo11+16.1.64-16.1.66-16.1.67-16.1.69-16.1.69-1~bpo11+16.1.76-16.1.76-1~bpo11+1 |
None known |
linuxDebian:13 |
All versions, plus listed versions 6.12.100-16.12.101-16.12.105-16.12.107-16.12.111-1 Show 45 moreShow less6.12.113-16.12.38-16.12.41-16.12.43-16.12.43-1~bpo12+16.12.48-16.12.57-16.12.57-1~bpo12+16.12.63-16.12.63-1~bpo12+16.12.69-16.12.69-1~bpo12+16.12.73-16.12.73-1~bpo12+16.12.74-16.12.74-26.12.74-2~bpo12+16.12.85-16.12.85-1~bpo12+16.12.86-16.12.86-1~bpo12+16.12.88-16.12.88-1~bpo12+16.12.90-16.12.90-1~bpo12+16.12.90-26.12.90-2~bpo12+16.12.94-16.12.94-1~bpo12+16.12.95-16.12.95-1~bpo12+16.12.96-16.13.10-1~exp16.13.11-1~exp16.13.2-1~exp16.13.3-1~exp16.13.4-1~exp16.13.5-1~exp16.13.6-1~exp16.13.7-1~exp16.13.8-1~exp16.13.9-1~exp16.13~rc6-1~exp16.13~rc7-1~exp16.14.3-1~exp1 |
None known |
linuxDebian:14 |
All versions, plus listed versions 6.12.100-16.12.101-16.12.105-16.12.107-16.12.111-1 Show 45 moreShow less6.12.113-16.12.38-16.12.41-16.12.43-16.12.43-1~bpo12+16.12.48-16.12.57-16.12.57-1~bpo12+16.12.63-16.12.63-1~bpo12+16.12.69-16.12.69-1~bpo12+16.12.73-16.12.73-1~bpo12+16.12.74-16.12.74-26.12.74-2~bpo12+16.12.85-16.12.85-1~bpo12+16.12.86-16.12.86-1~bpo12+16.12.88-16.12.88-1~bpo12+16.12.90-16.12.90-1~bpo12+16.12.90-26.12.90-2~bpo12+16.12.94-16.12.94-1~bpo12+16.12.95-16.12.95-1~bpo12+16.12.96-16.13.10-1~exp16.13.11-1~exp16.13.2-1~exp16.13.3-1~exp16.13.4-1~exp16.13.5-1~exp16.13.6-1~exp16.13.7-1~exp16.13.8-1~exp16.13.9-1~exp16.13~rc6-1~exp16.13~rc7-1~exp16.14.3-1~exp1 |
None known |
linuxRoot:Debian:11 |
before 5.10.262-1.aikido.113 | 5.10.262-1.aikido.1135.10.262-1.aikido.114 |
rootio-linuxRoot:Debian:11 |
before 5.10.262-1.aikido.113 | 5.10.262-1.aikido.1135.10.262-1.aikido.114 |
linuxRoot:Debian:12 |
before 6.1.190-1.aikido.167 | 6.1.190-1.aikido.167 |
rootio-linuxRoot:Debian:12 |
before 6.1.190-1.aikido.167 | 6.1.190-1.aikido.167 |
linuxRoot:Debian:13 |
before 6.12.115-2.aikido.164 | 6.12.115-2.aikido.164 |
rootio-linuxRoot:Debian:13 |
before 6.12.115-2.aikido.164 | 6.12.115-2.aikido.164 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mrclki/sockstress | 2016-05-06 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | OSV |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
References
blog.robertlee.name/2008/10/conjecture-speculation.html
cert.fi/haavoittuvuudet/2008/tcp-vulnerabilities.html
marc.info?l=bugtraq&m=125856010926699&w=2
lists.immunitysec.com/pipermail/dailydave/2008-October/005360.html
insecure.org/stf/tcp-dos-attack-explained.html
outpost24.com/news/news-2008-10-02.html
Show 12 moreShow less
cpni.gov.uk/Docs/tn-03-09-security-assessment-TCP.pdf
cisco.com/en/US/products/products_security_advisory09186a0080af511d.shtml
us-cert.gov/cas/techalerts/TA09-251A.html
oracle.com/technetwork/topics/security/cpujul2012-392727.html
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-048
searchsecurity.techtarget.com.au/articles/27154-TCP-is-fundamentally-borked
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6340
mandriva.com/security/advisories?name=MDVSA-2013:150
nvd.nist.gov/vuln/detail/CVE-2008-4609
github.com/advisories/GHSA-vf4j-pjcc-qf79
security-tracker.debian.org/tracker/CVE-2008-4609
Left out here: 598 versions. The JSON record has them.