CVE-2009-3476
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider...
CVE-2009-3476 is a high vulnerability (CVSS 9.3) in Internet2 Opensaml, published September 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.13%, the 90th percentile. Fixed in opensaml 3.0.0-2.
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
CVE-2009-3476- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
CVE-2009-3476- Updated
- 2026-11-02
EUVDEUVD-2009-3458 No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
EUVD-2009-3458- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvmf-6hr8-vcpv No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider...
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
GHSA-hvmf-6hr8-vcpv- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
CVE-2009-3476- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3476 No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
DEBIAN-CVE-2009-3476- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensamlDebian:12 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:13 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:14 |
before 3.0.0-2 | 3.0.0-2 |
shibboleth-spDebian:12 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:13 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:14 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
xmltoolingDebian:12 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:13 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:14 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:5.0 |
before 1.0-2+lenny1, plus listed versions 1.0-2 |
1.0-2+lenny1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensaml2Debian:5.0 |
before 2.0-2+lenny1, plus listed versions 2.0-2 |
2.0-2+lenny1 |
shibboleth-sp2Debian:5.0 |
before 2.0.dfsg1-4+lenny1, plus listed versions 2.0.dfsg1-4 |
2.0.dfsg1-4+lenny1 |
opensamlDebian:4.0 |
before 1.1a-2+etch1, plus listed versions 1.1a-2 |
1.1a-2+etch1 |
shibboleth-spDebian:4.0 |
before 1.3f.dfsg1-2+etch1, plus listed versions 1.3f.dfsg1-2 |
1.3f.dfsg1-2+etch1 |
opensamlDebian:5.0 |
before 1.1.1-2+lenny1, plus listed versions 1.1.1-21.1.1-2+lenny1~bpo40+1 |
1.1.1-2+lenny1 |
shibboleth-spDebian:5.0 |
before 1.3.1.dfsg1-3+lenny1, plus listed versions 1.3.1.dfsg1-31.3.1.dfsg1-3+lenny1~bpo40+1 |
1.3.1.dfsg1-3+lenny1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
secunia.com/advisories/36870
securityfocus.com/bid/36514
exchange.xforce.ibmcloud.com/vulnerabilities/53471
shibboleth.internet2.edu/secadv/secadv_20090826.txt
nvd.nist.gov/vuln/detail/CVE-2009-3476
github.com/advisories/GHSA-hvmf-6hr8-vcpv
security-tracker.debian.org/tracker/CVE-2009-3476