CVE-2020-25269
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains...
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
CVE-2020-25269- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:L/Au:S/C:N/I:N/A:C - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
CVE-2020-25269- Updated
- 2026-11-02
EUVDEUVD-2020-17957 No score
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
EUVD-2020-17957- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gw5w-x93w-mq79
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains...
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
GHSA-gw5w-x93w-mq79- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
CVE-2020-25269- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-25269
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
DEBIAN-CVE-2020-25269- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-25269
An issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with the sqlauth or sqloper modules, this vulnerability can be used for remote crashing of an InspIRCd server by any user able to connect to a server.
- Record
UBUNTU-CVE-2020-25269- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUSN-7405-1 No score
inspircd vulnerabilities
It was discovered that InspIRCd did not correctly handle certificate fingerprints, which could lead to spoofing. A remote attacker could possibly use this issue to bypass authentication. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-7142)
It was discovered that InspIRCd did not correctly handle certain memory operations, which could lead to a NULL pointer dereference. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-20917)
It was discovered that InspIRCd did not correctly handle certain memory operations, which could lead to a use-after-free. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2020-25269)
- Record
USN-7405-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
inspircdDebian:12 |
before 3.8.0-1 | 3.8.0-1 |
inspircdDebian:13 |
before 3.8.0-1 | 3.8.0-1 |
inspircdDebian:9 From an advisory covering 2 CVEs |
before 2.0.23-2+deb9u1, plus listed versions 2.0.23-2 |
2.0.23-2+deb9u1 |
inspircdDebian:10 From an advisory covering 2 CVEs |
before 2.0.27-1+deb10u1, plus listed versions 2.0.27-1 |
2.0.27-1+deb10u1 |
inspircdUbuntu:Pro:16.04:LTS |
before 2.0.20-5ubuntu0.1~esm1, plus listed versions 2.0.20-32.0.20-42.0.20-52.0.20-5build12.0.20-5build2 |
2.0.20-5ubuntu0.1~esm1 |
inspircdUbuntu:Pro:18.04:LTS |
before 2.0.24-1ubuntu1+esm1, plus listed versions 2.0.24-1ubuntu1 |
2.0.24-1ubuntu1+esm1 |
inspircdUbuntu:Pro:20.04:LTS |
before 3.4.0-2ubuntu1+esm1, plus listed versions 2.0.27-1ubuntu23.4.0-2ubuntu1 |
3.4.0-2ubuntu1+esm1 |
inspircdUbuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 2.0.20-5ubuntu0.1~esm1, plus listed versions 2.0.20-32.0.20-42.0.20-52.0.20-5build12.0.20-5build2 |
2.0.20-5ubuntu0.1~esm1 |
inspircdUbuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 2.0.24-1ubuntu1+esm1, plus listed versions 2.0.24-1ubuntu1 |
2.0.24-1ubuntu1+esm1 |
inspircdUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 3.4.0-2ubuntu1+esm1, plus listed versions 2.0.27-1ubuntu23.4.0-2ubuntu1 |
3.4.0-2ubuntu1+esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25269 is a medium vulnerability (CVSS 6.5) in Inspircd, published September 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.69%, the 85th percentile. Fixed in inspircd 3.8.0-1.