Every CVE Search/ Get API key

CVE-2020-6582

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small...

7.5 HighFix available

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

4.44%Up 3.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
CVE-2020-6582
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-681, CWE-787
Updated
2026-11-02
CVE List No score

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
CVE-2020-6582
Updated
2026-11-02
EUVDEUVD-2020-27730 No score

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
EUVD-2020-27730
Updated
2026-11-03
GitHub AdvisoriesGHSA-4wcp-4x6x-h4mf 7.5

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small...

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
GHSA-4wcp-4x6x-h4mf
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-787
Updated
2026-11-02
OSVALPINE-CVE-2020-6582 7.5

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
ALPINE-CVE-2020-6582
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
CVE-2020-6582
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-6582 7.5

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
DEBIAN-CVE-2020-6582
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-6582 7.5

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call.

Record
UBUNTU-CVE-2020-6582
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2020-0247 No score

Updated nrpe packages fix security vulnerability

Updated nrpe packages fix security vulnerabilities:

Nagios NRPE 3.2.1 has Insufficient Filtering because, for example, nasty_metachars interprets \n as the character \ and the character n (not as the \n newline sequence). This can cause command injection (CVE-2020-6581).

Nagios NRPE 3.2.1 has a Heap-Based Buffer Overflow, as demonstrated by interpretation of a small negative number as a large positive number during a bzero call (CVE-2020-6582).

Record
MGASA-2020-0247
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nrpe
Alpine:v3.13
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.14
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.15
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.16
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.18
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.19
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.20
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.21
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.22
before 4.0.0-r0
4.0.0-r0
nrpe
Alpine:v3.23
before 4.0.0-r0
4.0.0-r0
Show 7 moreShow less
Affected packages
PackageAffectedFixed
nrpe
Alpine:v3.24
before 4.0.0-r0
4.0.0-r0
nagios-nrpe
Debian:12
before 4.0.0-1
4.0.0-1
nagios-nrpe
Debian:13
before 4.0.0-1
4.0.0-1
nagios-nrpe
Debian:14
before 4.0.0-1
4.0.0-1
nrpe
Mageia:7
before 3.2.1-3.2.mga7
3.2.1-3.2.mga7
nagios-nrpe
Ubuntu:16.04:LTS
All versions, plus listed versions
2.15-1ubuntu12.15-1ubuntu1.1
None known
nagios-nrpe
Ubuntu:18.04:LTS
All versions, plus listed versions
3.2.0-4ubuntu23.2.1-1ubuntu1
None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-6582 is a high vulnerability (CVSS 7.5) in Fedoraproject Fedora, published March 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.44%, the 91st percentile. Fixed in nrpe 4.0.0-r0.

References

Show 8 moreShow less
MoveEnter Open