CVE-2020-28241

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

6.5 MediumFix available

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.16%Up 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: CVE-2020-28241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness: CWE-125
Updated: 2026-11-02

CVE List No score

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: CVE-2020-28241
Updated: 2026-11-02

EUVDEUVD-2020-20725 No score

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: EUVD-2020-20725
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8h2q-prr9-7wh9 No score

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: GHSA-8h2q-prr9-7wh9
Weakness: CWE-125, CWE-787
Updated: 2026-11-02

OSVALPINE-CVE-2020-28241 6.5

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: ALPINE-CVE-2020-28241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVBELL-CVE-2020-28241 6.5

CVE-2020-28241 does not affect BellSoft software

Record: BELL-CVE-2020-28241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 13 moreShow less

OSV 6.5

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: CVE-2020-28241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-28241 6.5

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: DEBIAN-CVE-2020-28241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVOESA-2021-1287 6.5

libmaxminddb security update

The libmaxminddb library provides a C library for reading MaxMind DB files, including the GeoIP2 databases from MaxMind. This is a custom binary format designed to facilitate fast lookups of IP addresses while allowing for great flexibility in the type of data associated with an address.

Security Fix(es):

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.(CVE-2020-28241)

Record: OESA-2021-1287
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:0750 6.5

Red Hat Security Advisory: libmaxminddb security update

Record: RHSA-2024:0750
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:0751 6.5

Red Hat Security Advisory: libmaxminddb security update

Record: RHSA-2024:0751
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:0768 6.5

Red Hat Security Advisory: libmaxminddb security update

Record: RHSA-2024:0768
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-28241 6.5

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: UBUNTU-CVE-2020-28241
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2024:0768 No score

Moderate: libmaxminddb security update

The libmaxminddb package contains the MaxMind DB library.

Security Fix(es):

libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2024:0768
Updated: 2026-11-02

OSVBIT-libmaxminddb-2020-28241 No score

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c.

Record: BIT-libmaxminddb-2020-28241
Updated: 2026-11-02

OSVMGASA-2020-0471 No score

Updated libmaxminddb packages fix security vulnerability

libmaxminddb before 1.4.3 has a heap-based buffer over-read in dump_entry_data_list in maxminddb.c (CVE-2020-28241).

Record: MGASA-2020-0471
Updated: 2026-11-02

OSVRLSA-2024:0768 No score

Moderate: libmaxminddb security update

The libmaxminddb package contains the MaxMind DB library.

Security Fix(es):

libmaxminddb: improper initialization in dump_entry_data_list() in maxminddb.c (CVE-2020-28241)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2024:0768
Updated: 2026-11-02

OSVUSN-4631-1 No score

libmaxminddb vulnerability

It was discovered that libmaxminddb incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause applications using libmaxminddb to crash, resulting in a denial of service.

Record: USN-4631-1
Updated: 2026-11-02

OSVUSN-5751-1 No score

libmaxminddb vulnerability

Record: USN-5751-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libmaxminddb` Alpine:v3.10	before 1.3.2-r1	1.3.2-r1
`libmaxminddb` Alpine:v3.11	before 1.4.2-r2	1.4.2-r2
`libmaxminddb` Alpine:v3.12	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.13	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.14	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.15	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.16	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.17	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.18	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.19	before 1.4.3-r0	1.4.3-r0

Show 31 moreShow less

Affected packages
Package	Affected	Fixed
`libmaxminddb` Alpine:v3.20	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.21	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.22	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.23	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` Alpine:v3.24	before 1.4.3-r0	1.4.3-r0
`libmaxminddb` AlmaLinux:8	before 1.2.0-10.el8_9.1	1.2.0-10.el8_9.1
`libmaxminddb-devel` AlmaLinux:8	before 1.2.0-10.el8_9.1	1.2.0-10.el8_9.1
`libmaxminddb` Bitnami	before 1.4.3	1.4.3
`libmaxminddb` Debian:12	before 1.4.3-1	1.4.3-1
`libmaxminddb` Debian:13	before 1.4.3-1	1.4.3-1
`libmaxminddb` Debian:14	before 1.4.3-1	1.4.3-1
`libmaxminddb` Debian:9	before 1.2.0-1+deb9u1, plus listed versions 1.2.0-1	1.2.0-1+deb9u1
`libmaxminddb` Mageia:7	before 1.3.2-3.1.mga7	1.3.2-3.1.mga7
`libmaxminddb` openEuler:20.03-LTS-SP1	before 1.2.0-8.oe1	1.2.0-8.oe1
`libmaxminddb` openEuler:20.03-LTS-SP2	before 1.2.0-8.oe1	1.2.0-8.oe1
`libmaxminddb` Red Hat:rhel_eus:8.8::appstream	before 0:1.2.0-10.el8_8.1	0:1.2.0-10.el8_8.1
`libmaxminddb-debuginfo` Red Hat:rhel_eus:8.8::appstream	before 0:1.2.0-10.el8_8.1	0:1.2.0-10.el8_8.1
`libmaxminddb-debugsource` Red Hat:rhel_eus:8.8::appstream	before 0:1.2.0-10.el8_8.1	0:1.2.0-10.el8_8.1
`libmaxminddb-devel` Red Hat:rhel_eus:8.8::appstream	before 0:1.2.0-10.el8_8.1	0:1.2.0-10.el8_8.1
`libmaxminddb` Red Hat:rhel_eus:8.6::appstream	before 0:1.2.0-10.el8_6.1	0:1.2.0-10.el8_6.1
`libmaxminddb-debuginfo` Red Hat:rhel_eus:8.6::appstream	before 0:1.2.0-10.el8_6.1	0:1.2.0-10.el8_6.1
`libmaxminddb-debugsource` Red Hat:rhel_eus:8.6::appstream	before 0:1.2.0-10.el8_6.1	0:1.2.0-10.el8_6.1
`libmaxminddb-devel` Red Hat:rhel_eus:8.6::appstream	before 0:1.2.0-10.el8_6.1	0:1.2.0-10.el8_6.1
`libmaxminddb` Red Hat:enterprise_linux:8::appstream	before 0:1.2.0-10.el8_9.1	0:1.2.0-10.el8_9.1
`libmaxminddb-debuginfo` Red Hat:enterprise_linux:8::appstream	before 0:1.2.0-10.el8_9.1	0:1.2.0-10.el8_9.1
`libmaxminddb-debugsource` Red Hat:enterprise_linux:8::appstream	before 0:1.2.0-10.el8_9.1	0:1.2.0-10.el8_9.1
`libmaxminddb-devel` Red Hat:enterprise_linux:8::appstream	before 0:1.2.0-10.el8_9.1	0:1.2.0-10.el8_9.1
`libmaxminddb` Rocky Linux:8	before 0:1.2.0-10.el8_9.1	0:1.2.0-10.el8_9.1
`libmaxminddb` Ubuntu:Pro:16.04:LTS	before 1.0.4-2.1ubuntu0.1~esm1, plus listed versions 1.0.4-21.0.4-2.1	1.0.4-2.1ubuntu0.1~esm1
`libmaxminddb` Ubuntu:18.04:LTS	All versions, plus listed versions 1.2.1-11.3.1-1	None known
`libmaxminddb` Ubuntu:20.04:LTS	before 1.4.2-0ubuntu1.20.04.1, plus listed versions 1.3.2-11.4.2-0ubuntu1	1.4.2-0ubuntu1.20.04.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-28241 is a medium vulnerability (CVSS 6.5) in Maxmind Libmaxminddb, published November 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in libmaxminddb 1.3.2-r1.

References

Show 29 moreShow less