CVE-2020-27638

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets...

7.5 HighFix available

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.36%Up 0.3 points since Apr 14, 2021

What each source reports

NVD Score used 7.5

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Record: CVE-2020-27638
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness: CWE-617
Updated: 2026-11-02

CVE List No score

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Record: CVE-2020-27638
Updated: 2026-11-02

EUVDEUVD-2020-20145 No score

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Record: EUVD-2020-20145
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5qg6-2968-fxg3 7.5

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets...

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Record: GHSA-5qg6-2968-fxg3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-119, CWE-617
Updated: 2026-11-02

OSV 7.5

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Record: CVE-2020-27638
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-27638 7.5

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Record: DEBIAN-CVE-2020-27638
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-27638 7.5

receive.c in fastd before v21 allows denial of service (assertion failure) when receiving packets with an invalid type code.

Record: UBUNTU-CVE-2020-27638
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUSN-4610-1 No score

fastd vulnerability

It was discovered that fastd did not properly handle receive buffers under certain circumstances. A remote attacker could possibly use this issue to cause a memory leak, resulting in a denial of service. (CVE-2020-27638)

Record: USN-4610-1
Updated: 2026-11-02

OSVUSN-4718-1 No score

fastd vulnerability

It was discovered that fastd incorrectly handled certain packets. An attacker could possibly use this issue to cause a denial of service.

Record: USN-4718-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`fastd` Debian:12	before 21-1	21-1
`fastd` Debian:13	before 21-1	21-1
`fastd` Debian:14	before 21-1	21-1
`fastd` Debian:9	before 18-2+deb9u1, plus listed versions 18-2	18-2+deb9u1
`fastd` Ubuntu:16.04:LTS	before 17-4ubuntu0.1, plus listed versions 17-417-4build1	17-4ubuntu0.1
`fastd` Ubuntu:18.04:LTS	before 18-3ubuntu0.18.04.1, plus listed versions 18-218-2ubuntu118-2ubuntu218-3	18-3ubuntu0.18.04.1
`fastd` Ubuntu:20.04:LTS	before 18-3ubuntu0.1, plus listed versions 18-3build1	18-3ubuntu0.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-27638 is a high vulnerability (CVSS 7.5) in Fastd Project Fastd, published October 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.36%, the 83rd percentile. Fixed in fastd 21-1.

References

Show 11 moreShow less