Every CVE Search/ Get API key

CVE-2026-39894

Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting

2.9 LowFix available

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.14%Unchanged since Jun 25, 2026
90%50%10%1%

What each source reports

CVE List Score used 2.9

Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Record
CVE-2026-39894
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-474
Updated
2026-11-02
EUVDEUVD-2026-39132 2.9

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Record
EUVD-2026-39132
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
NVD 2.9

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Record
CVE-2026-39894
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-474
Updated
2026-11-02
OSV 2.9

Cacti: RRDtool metric shift via LC_NUMERIC locale comma decimal formatting

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Record
CVE-2026-39894
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-474
Updated
2026-11-02
OSVDEBIAN-CVE-2026-39894 2.5

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Record
DEBIAN-CVE-2026-39894
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-39894 2.9

Cacti is an open source performance and fault management framework. In versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. The rrdtool_function_update() function checks metric values with is_numeric() and concatenates them into the RRDtool update command via PHP string interpolation. PHP's string cast of floats is locale-sensitive: if LC_NUMERIC uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes "1,5". RRDtool expects . as decimal separator, causing metric data to shift into wrong columns or be silently dropped. No setlocale() reset is present in the update path. This causes a data integrity issue, but is not remotely exploitable; it requires server locale misconfiguration. The issue has been fixed in version 1.2.31.

Record
UBUNTU-CVE-2026-39894
CVSS 3.1
2.9 LowCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 3.1
2.5 LowCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cacti
Debian:12
 All versions, plus listed versions
1.2.24+ds1-11.2.24+ds1-1+deb12u11.2.24+ds1-1+deb12u21.2.24+ds1-1+deb12u31.2.24+ds1-1+deb12u4
Show 17 moreShow less
1.2.24+ds1-1+deb12u51.2.25+ds1-11.2.25+ds1-21.2.26+ds1-11.2.27+ds1-11.2.27+ds1-21.2.28+ds1-11.2.28+ds1-21.2.28+ds1-31.2.28+ds1-41.2.30+ds1-11.2.30+ds1-21.2.30+ds1-31.2.31+ds1-11.2.31+ds1-21.2.31+ds1-31.2.31+ds1-4
 None known
cacti
Debian:13
 All versions, plus listed versions
1.2.30+ds1-11.2.30+ds1-21.2.30+ds1-31.2.31+ds1-11.2.31+ds1-21.2.31+ds1-31.2.31+ds1-4
 None known
cacti
Debian:14
 before 1.2.31+ds1-1, plus listed versions
1.2.30+ds1-11.2.30+ds1-21.2.30+ds1-3
1.2.31+ds1-1
cacti
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
0.8.8b+dfsg-30.8.8b+dfsg-50.8.8b+dfsg-5ubuntu0.10.8.8b+dfsg-5ubuntu0.20.8.8b+dfsg-5ubuntu0.2+esm10.8.8b+dfsg-5ubuntu0.2+esm2
 None known
cacti
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
0.8.8f+ds1-20.8.8f+ds1-30.8.8f+ds1-40.8.8f+ds1-4ubuntu10.8.8f+ds1-4ubuntu2
Show 7 moreShow less
0.8.8f+ds1-4ubuntu30.8.8f+ds1-4ubuntu40.8.8f+ds1-4ubuntu4.16.040.8.8f+ds1-4ubuntu4.16.04.10.8.8f+ds1-4ubuntu4.16.04.20.8.8f+ds1-4ubuntu4.16.04.2+esm10.8.8f+ds1-4ubuntu4.16.04.2+esm2
 None known
cacti
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
1.1.18+ds1-11.1.27+ds1-21.1.27+ds1-31.1.28+ds1-21.1.35+ds1-1
Show 5 moreShow less
1.1.36+ds1-11.1.38+ds1-11.1.38+ds1-1ubuntu0.1~esm11.1.38+ds1-1ubuntu0.1~esm31.1.38+ds1-1ubuntu0.1~esm4
 None known
cacti
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
1.2.4+ds1-2ubuntu31.2.9+ds1-1ubuntu11.2.9+ds1-1ubuntu21.2.10+ds1-1ubuntu11.2.10+ds1-1ubuntu1+esm11.2.10+ds1-1ubuntu1.11.2.10+ds1-1ubuntu1.1+esm11.2.10+ds1-1ubuntu1.1+esm2
 None known
cacti
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
1.2.16+ds1-2ubuntu11.2.19+ds1-2ubuntu11.2.19+ds1-2ubuntu1+esm11.2.19+ds1-2ubuntu1.11.2.19+ds1-2ubuntu1.1+esm11.2.19+ds1-2ubuntu1.1+esm2
 None known
cacti
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.2.25+ds1-21.2.26+ds1-11.2.26+ds1-1ubuntu0.1
 None known
cacti
Ubuntu:25.10
 All versions, plus listed versions
1.2.28+ds1-4ubuntu11.2.30+ds1-1ubuntu1
 None known
cacti
Ubuntu:26.10
 All versions, plus listed versions
1.2.30+ds1-1ubuntu21.2.30+ds1-1ubuntu31.2.31+ds1-3ubuntu2
 None known
cacti
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.2.30+ds1-1ubuntu11.2.30+ds1-1ubuntu2
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-39894 is a low vulnerability (CVSS 2.9) in Cacti, published June 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in cacti 1.2.31+ds1-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open