CVE-2009-3476
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider...
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
CVE-2009-3476- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
CVE-2009-3476- Updated
- 2026-11-02
EUVDEUVD-2009-3458 No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
EUVD-2009-3458- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvmf-6hr8-vcpv No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider...
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
GHSA-hvmf-6hr8-vcpv- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
CVE-2009-3476- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3476 No score
Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.
- Record
DEBIAN-CVE-2009-3476- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opensamlDebian:12 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:13 |
before 3.0.0-2 | 3.0.0-2 |
opensamlDebian:14 |
before 3.0.0-2 | 3.0.0-2 |
shibboleth-spDebian:12 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:13 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
shibboleth-spDebian:14 |
before 3.0.2+dfsg1-2 | 3.0.2+dfsg1-2 |
xmltoolingDebian:12 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:13 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:14 |
before 1.2.2-1 | 1.2.2-1 |
xmltoolingDebian:5.0 From an advisory covering 3 CVEs |
before 1.0-2+lenny1, plus listed versions 1.0-2 |
1.0-2+lenny1 |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opensaml2Debian:5.0 From an advisory covering 3 CVEs |
before 2.0-2+lenny1, plus listed versions 2.0-2 |
2.0-2+lenny1 |
shibboleth-sp2Debian:5.0 From an advisory covering 3 CVEs |
before 2.0.dfsg1-4+lenny1, plus listed versions 2.0.dfsg1-4 |
2.0.dfsg1-4+lenny1 |
opensamlDebian:4.0 From an advisory covering 3 CVEs |
before 1.1a-2+etch1, plus listed versions 1.1a-2 |
1.1a-2+etch1 |
shibboleth-spDebian:4.0 From an advisory covering 3 CVEs |
before 1.3f.dfsg1-2+etch1, plus listed versions 1.3f.dfsg1-2 |
1.3f.dfsg1-2+etch1 |
opensamlDebian:5.0 From an advisory covering 3 CVEs |
before 1.1.1-2+lenny1, plus listed versions 1.1.1-21.1.1-2+lenny1~bpo40+1 |
1.1.1-2+lenny1 |
shibboleth-spDebian:5.0 From an advisory covering 3 CVEs |
before 1.3.1.dfsg1-3+lenny1, plus listed versions 1.3.1.dfsg1-31.3.1.dfsg1-3+lenny1~bpo40+1 |
1.3.1.dfsg1-3+lenny1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-3476 is a high vulnerability (CVSS 9.3) in Internet2 Opensaml, published September 24, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.13%, the 90th percentile. Fixed in opensaml 3.0.0-2.
References
secunia.com/advisories/36870
securityfocus.com/bid/36514
exchange.xforce.ibmcloud.com/vulnerabilities/53471
shibboleth.internet2.edu/secadv/secadv_20090826.txt
nvd.nist.gov/vuln/detail/CVE-2009-3476
github.com/advisories/GHSA-hvmf-6hr8-vcpv
security-tracker.debian.org/tracker/CVE-2009-3476