CVE-2024-0901

SEGV and out of bounds memory read from malicious packet

7.5 HighFix available

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: High

Exploit likelihood

0.69%Up 0.7 points since Mar 26, 2024

What each source reports

CVE List Score used 7.5

SEGV and out of bounds memory read from malicious packet

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: CVE-2024-0901
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Weakness: CWE-129
Updated: 2026-11-02

EUVDEUVD-2024-16683 7.5

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: EUVD-2024-16683
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qrv4-68mg-fv43 7.5

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an...

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: GHSA-qrv4-68mg-fv43
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Weakness: CWE-129
Updated: 2026-11-02

NVD 7.5

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: CVE-2024-0901
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Weakness: CWE-129
Updated: 2026-11-02

OSVALPINE-CVE-2024-0901 9.1

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: ALPINE-CVE-2024-0901
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-03

OSVBELL-CVE-2024-0901 9.1

Record: BELL-CVE-2024-0901
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSV 7.5

SEGV and out of bounds memory read from malicious packet

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: CVE-2024-0901
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
Weakness: CWE-129
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-0901 9.1

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: DEBIAN-CVE-2024-0901
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVJLSEC-2026-680 9.1

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an...

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: JLSEC-2026-680
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-0901 7.5

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: UBUNTU-CVE-2024-0901
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H
CVSS 3.1: 9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Updated: 2026-11-02

OSVAZL-37112 No score

CVE-2024-0901 affecting package mariadb for versions less than 10.11.6-3

Remotely executed SEGV and out of bounds read allows malicious packet sender to crash or cause an out of bounds read via sending a malformed packet with the correct length.

Record: AZL-37112
Updated: 2026-11-02

Affected products

wolfssl

Affected packages

Affected packages
Package	Affected	Fixed
`wolfssl` Alpine:v3.20	3.12.2 up to 5.7.0-r0	5.7.0-r0
`wolfssl` Alpine:v3.21	3.12.2 up to 5.7.0-r0	5.7.0-r0
`wolfssl` Alpine:v3.22	3.12.2 up to 5.7.0-r0	5.7.0-r0
`wolfssl` Alpine:v3.23	3.12.2 up to 5.7.0-r0	5.7.0-r0
`wolfssl` Alpine:v3.24	3.12.2 up to 5.7.0-r0	5.7.0-r0
`mariadb` Azure Linux:3	before 10.11.6-3	10.11.6-3
`wolfssl` Alpaquita:23	5.5.3-r0 and later	None known
`wolfssl` Alpaquita:stream	5.5.4-r0 up to 5.7.0-r0	5.7.0-r0
`wolfssl` Debian:12	All versions, plus listed versions 5.5.4-25.5.4-2+deb12u15.5.4-2+deb12u25.5.4-2+deb12u35.5.4-2.1 Show 24 moreShow less 5.6.4-15.6.4-25.6.6-15.6.6-1.15.6.6-1.25.6.6-1.35.6.6-1.3~exp15.7.0-0.15.7.0-0.25.7.0-0.35.7.2-0.15.7.2-0.25.7.2-0.35.7.2-0.45.8.2-15.8.2-1.15.8.2-1.25.8.4-15.9.0-0.15.9.0-0.25.9.1-0.15.9.2-15.9.2-1.15.9.2-1.2	None known
`wolfssl` Debian:13	before 5.7.0-0.3	5.7.0-0.3

Show 9 moreShow less

Affected packages
Package	Affected	Fixed
`wolfSSL_jll` Julia	before 5.7.2+0	5.7.2+0
`wolfssl` Ubuntu:16.04:LTS	All versions, plus listed versions 3.4.8+dfsg-1	None known
`wolfssl` Ubuntu:18.04:LTS	All versions, plus listed versions 3.10.2+dfsg-23.12.0+dfsg-13.12.2+dfsg-13.13.0+dfsg-1	None known
`wolfssl` Ubuntu:20.04:LTS	All versions, plus listed versions 4.1.0+dfsg-24.2.0+dfsg-14.2.0+dfsg-24.2.0+dfsg-34.3.0+dfsg-2	None known
`wolfssl` Ubuntu:22.04:LTS	All versions, plus listed versions 4.6.0-35.0.0-15.1.1-15.2.0-15.2.0-2	None known
`wolfssl` Ubuntu:24.04:LTS	All versions, plus listed versions 5.5.4-25.5.4-2.15.6.4-25.6.6-1.25.6.6-1.35.6.6-1.3build1	None known
`wolfssl` Ubuntu:25.10	All versions, plus listed versions 5.7.2-0.1	None known
`wolfssl` Ubuntu:26.10	All versions, plus listed versions 5.9.1-0.15.9.2-1	None known
`wolfssl` Ubuntu:26.04:LTS	All versions, plus listed versions 5.7.2-0.15.8.2-1.25.8.4-15.9.1-0.1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-0901 is a high vulnerability (CVSS 7.5) in Wolfssl, published March 25, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in wolfssl 5.7.0-r0.

References

Show 5 moreShow less