CVE-2009-4413
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other...
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.
Exploit likelihood
What each source reports
NVD Score used
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.
- Record
CVE-2009-4413- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-189
- Updated
- 2026-11-02
CVE List No score
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.
- Record
CVE-2009-4413- Updated
- 2026-11-02
EUVDEUVD-2009-4380 No score
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.
- Record
EUVD-2009-4380- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-739g-q9wv-464j No score
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other...
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.
- Record
GHSA-739g-q9wv-464j- Updated
- 2026-11-02
OSV No score
The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a large Content-Length value, which triggers an integer overflow, a signed-to-unsigned conversion error with a negative value, and a segmentation fault.
- Record
CVE-2009-4413- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
polipoDebian:5.0 From an advisory covering 2 CVEs |
before 1.0.4-1+lenny1, plus listed versions 1.0.4-1 |
1.0.4-1+lenny1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Polipo 1.0.4 - Remote Memory Corruption (PoC) | 2009-12-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-4413 is a medium vulnerability (CVSS 5.0) in Pps.jussieu Polipo, published December 24, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.66%, the 95th percentile. No source names a fixed version.
References
securityfocus.com/bid/37463
openwall.com/lists/oss-security/2009/12/12/4
secunia.com/advisories/38647
bugs.debian.org/cgi-bin/bugreport.cgi?bug=560779
exploit-db.com/exploits/10338
debian.org/security/2010/dsa-2002
nvd.nist.gov/vuln/detail/CVE-2009-4413
github.com/advisories/GHSA-739g-q9wv-464j