CVE-2016-8606

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via...

9.8 CriticalFix available

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

4.22%Up 1.6 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Record: CVE-2016-8606
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Record: CVE-2016-8606
Updated: 2026-11-02

EUVDEUVD-2016-9453 No score

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Record: EUVD-2016-9453
Updated: 2026-11-03

GitHub AdvisoriesGHSA-vqrx-mf37-8x6h 9.8

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via...

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Record: GHSA-vqrx-mf37-8x6h
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSVALPINE-CVE-2016-8606 9.8

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Record: ALPINE-CVE-2016-8606
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.8

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Record: CVE-2016-8606
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2016-8606 9.8

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Record: UBUNTU-CVE-2016-8606
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2016-0354 No score

Updated guile packages fix security vulnerability

The ‘mkdir’ procedure of GNU Guile, an implementation of the Scheme programming language, temporarily changed the process’ umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure permissions (CVE-2016-8605).

GNU Guile, an implementation of the Scheme language, provides a “REPL server” which is a command prompt that developers can connect to for live coding and debugging purposes. The REPL server is vulnerable to the HTTP inter-protocol attack. This constitutes a remote code execution vulnerability for developers running a REPL server that listens on a loopback device or private network (CVE-2016-8606).

The guile package has been updated to version 2.0.13, fixing these issues and other bugs. See the upstream release announcements for details.

Record: MGASA-2016-0354
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10389-1 No score

guile-2.0.13-2.1 on GA media

These are all security issues fixed in the guile-2.0.13-2.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10389-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`guile` Alpine:v3.4	before 2.0.11-r3	2.0.11-r3
`guile-2.0` Debian:7	before 2.0.5+1-3+deb7u1, plus listed versions 2.0.5+1-3	2.0.5+1-3+deb7u1
`guile` Mageia:5	before 2.0.13-1.mga5	2.0.13-1.mga5
`guile-2.0` Ubuntu:16.04:LTS	All versions, plus listed versions 2.0.11+1-9ubuntu12.0.11+1-102.0.11+1-10ubuntu0.1	None known
`guile` openSUSE:Tumbleweed	before 2.0.13-2.1	2.0.13-2.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-8606 is a critical vulnerability (CVSS 9.8) in Gnu Guile, published October 18, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.22%, the 91st percentile. Fixed in guile 2.0.11-r3.

References

Show 13 moreShow less