CVE-2020-8244
Remote Memory Exposure in bl
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
CVE-2020-8244- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-126, CWE-125
- Updated
- 2026-11-02
CVE List No score
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
CVE-2020-8244- Weakness
- CWE-126
- Updated
- 2026-11-02
EUVDEUVD-2020-1218 No score
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
EUVD-2020-1218- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pp7h-53gx-mx7r
Remote Memory Exposure in bl
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
GHSA-pp7h-53gx-mx7r- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-125, CWE-126
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wrw9-m778-g6mc No score
Memory Exposure in bl
Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure.
bl.append(number) in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory
Recommendation
Update to version 0.9.5, 1.0.1 or later.
- Record
GHSA-wrw9-m778-g6mc- Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
CVE-2020-8244- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
Show 10 moreShow less
OSVDEBIAN-CVE-2020-8244
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
DEBIAN-CVE-2020-8244- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-pp7h-53gx-mx7r
Remote Memory Exposure in bl
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
GHSA-pp7h-53gx-mx7r- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Weakness
- CWE-125, CWE-126
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8244
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
- Record
UBUNTU-CVE-2020-8244- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVCLSA-2026-1772756021 No score
TuxCare security update for bl (2 CVEs)
TuxCare rebuilt bl to address 2 CVEs. Fixed in 1.0.0-tuxcare.1.
- Record
CLSA-2026-1772756021- Updated
- 2026-11-02
OSVCLSA-2026-1774225189 No score
TuxCare security update for bl (1 CVE)
TuxCare rebuilt bl to address 1 CVE. Fixed in 0.9.5-tuxcare.1.
- Record
CLSA-2026-1774225189- Updated
- 2026-11-02
OSVCLSA-2026-1776731791 No score
TuxCare security update for bl (1 CVE)
TuxCare rebuilt bl to address 1 CVE. Fixed in 1.1.2-tuxcare.1.
- Record
CLSA-2026-1776731791- Updated
- 2026-11-02
OSVCLSA-2026-1792491634 No score
TuxCare security update for bl (2 CVEs)
TuxCare rebuilt bl to address 2 CVEs. Fixed in 0.8.2-tuxcare.1.
- Record
CLSA-2026-1792491634- Updated
- 2026-11-02
OSVGHSA-wrw9-m778-g6mc No score
Memory Exposure in bl
Versions of bl before 0.9.5 and 1.0.1 are vulnerable to memory exposure.
bl.append(number) in the affected bl versions passes a number to Buffer constructor, appending a chunk of uninitialized memory
Recommendation
Update to version 0.9.5, 1.0.1 or later.
- Record
GHSA-wrw9-m778-g6mc- Weakness
- CWE-200
- Updated
- 2026-11-02
OSVUSN-5098-1 No score
node-bl vulnerability
It was discovered that bl didn't properly sanitize the inputs. An attacker could use this to leak sensitive information.
- Record
USN-5098-1- Updated
- 2026-11-02
OSVUSN-5159-1 No score
node-bl vulnerability
It was discovered that bl incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-5159-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
blnpm |
3.0.0 to 3.0.0 | 3.0.1 |
blnpm |
4.0.0 up to 4.0.3 | 4.0.3 |
blnpm |
before 1.2.3 | 1.2.3 |
blnpm |
2.0.0 up to 2.2.1 | 2.2.1 |
blnpm |
before 0.9.5 | 0.9.5 |
blnpm |
1.0.0 to 1.0.0 | 1.0.1 |
blTuxCare:npm |
1.0.0-tuxcare.0 up to 1.0.0-tuxcare.1, plus listed versions 1.0.0 |
1.0.0-tuxcare.1 |
blTuxCare:npm |
0.9.5-tuxcare.0 up to 0.9.5-tuxcare.1, plus listed versions 0.9.5 |
0.9.5-tuxcare.1 |
blTuxCare:npm |
1.1.2-tuxcare.0 up to 1.1.2-tuxcare.1, plus listed versions 1.1.2 |
1.1.2-tuxcare.1 |
blTuxCare:npm |
0.8.2-tuxcare.0 up to 0.8.2-tuxcare.1, plus listed versions 0.8.2 |
0.8.2-tuxcare.1 |
Show 9 moreShow less
| Package | Affected | Fixed |
|---|---|---|
node-blDebian:12 |
before 4.0.3-1 | 4.0.3-1 |
node-blDebian:13 |
before 4.0.3-1 | 4.0.3-1 |
node-blDebian:14 |
before 4.0.3-1 | 4.0.3-1 |
node-blDebian:9 |
before 1.1.2-1+deb9u1, plus listed versions 1.1.2-1 |
1.1.2-1+deb9u1 |
blnpm |
3.0.0 up to 3.0.1 | 3.0.1 |
blnpm |
1.0.0 up to 1.0.1 | 1.0.1 |
node-blUbuntu:Pro:16.04:LTS |
before 0.9.3-1ubuntu0.1~esm1, plus listed versions 0.9.3-1 |
0.9.3-1ubuntu0.1~esm1 |
node-blUbuntu:18.04:LTS |
before 1.1.2-1ubuntu1.1, plus listed versions 1.1.2-11.1.2-1ubuntu1 |
1.1.2-1ubuntu1.1 |
node-blUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.2-34.0.0-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8244 is a medium vulnerability (CVSS 6.5) in Bufferlist Project Bufferlist, published June 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.10%, the 81st percentile. Fixed in bl 3.0.1.
References
hackerone.com/reports/966347
lists.debian.org/debian-lts-announce/2021/06/msg00028.html
nvd.nist.gov/vuln/detail/CVE-2020-8244
github.com/rvagg/bl/commit/8a8c13c880e2bef519133ea43e0e9b78b5d0c91e
Show 9 moreShow less
npmjs.com/advisories/596
security-tracker.debian.org/tracker/CVE-2020-8244
ubuntu.com/security/CVE-2020-8244
cve.org/CVERecord?id=CVE-2020-8244