CVE-2020-26566
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
- Record
CVE-2020-26566- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
- Record
CVE-2020-26566- Updated
- 2026-11-02
EUVDEUVD-2020-19111 No score
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
- Record
EUVD-2020-19111- Updated
- 2026-11-03
OSV
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
- Record
CVE-2020-26566- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-26566
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
- Record
DEBIAN-CVE-2020-26566- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-26566
A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP request.
- Record
UBUNTU-CVE-2020-26566- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
motionDebian:12 |
before 4.3.2-1 | 4.3.2-1 |
motionDebian:13 |
before 4.3.2-1 | 4.3.2-1 |
motionDebian:14 |
before 4.3.2-1 | 4.3.2-1 |
motionUbuntu:16.04:LTS |
All versions, plus listed versions 3.2.12+git20140228-73.2.12+git20140228-83.2.12+git20140228-8build1 |
None known |
motionUbuntu:18.04:LTS |
All versions, plus listed versions 4.0-1 |
None known |
motionUbuntu:20.04:LTS |
All versions, plus listed versions 4.2.2-1build14.2.2-1ubuntu1 |
None known |
motionUbuntu:22.04:LTS |
All versions, plus listed versions 4.3.2-14.3.2-1ubuntu0.1 |
None known |
motionUbuntu:24.04:LTS |
All versions, plus listed versions 4.5.1-3build14.5.1-44.6.0-14.6.0-1ubuntu14.6.0-1ubuntu2 |
None known |
motionUbuntu:25.10 |
All versions, plus listed versions 4.7.0-2build14.7.0-3 |
None known |
motionUbuntu:26.10 |
All versions, plus listed versions 4.7.1-1build14.7.1-2 |
None known |
motionUbuntu:26.04:LTS |
All versions, plus listed versions 4.7.0-34.7.1-14.7.1-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-26566 is a high vulnerability (CVSS 7.5) in Motion Project Motion, published October 26, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.36%, the 91st percentile. Fixed in motion 4.3.2-1.
References
motion-project.github.io/index.html
github.com/Motion-Project/motion/releases
security.gentoo.org/glsa/202208-18
security-tracker.debian.org/tracker/CVE-2020-26566
ubuntu.com/security/CVE-2020-26566
cve.org/CVERecord?id=CVE-2020-26566