CVE-2026-63201

Netopeer2 is a server for implementing network configuration management based on the NETCONF Protocol. In affected versions, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter whose text contains format specifiers. In src/netconf.c, np2srv_rpc_get_cb() sends the invalid value through ERR() to np2log_printf(), where vsnprintf() first formats the message safely. In src/log.c, that already formatted buffer is subsequently passed to np2log() as the format string itself, causing vsyslog() to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using NETCONF-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. The advisory identifies 2.8.8 as patched; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.

Netopeer2 is a server for implementing network configuration management based on the NETCONF Protocol. In affected versions, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter whose text contains format specifiers. In src/netconf.c, np2srv_rpc_get_cb() sends the invalid value through ERR() to np2log_printf(), where vsnprintf() first formats the message safely. In src/log.c, that already formatted buffer is subsequently passed to np2log() as the format string itself, causing vsyslog() to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using NETCONF-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. The advisory identifies 2.8.8 as patched; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.

Netopeer2 is a server for implementing network configuration management based on the NETCONF Protocol. In affected versions, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter whose text contains format specifiers. In src/netconf.c, np2srv_rpc_get_cb() sends the invalid value through ERR() to np2log_printf(), where vsnprintf() first formats the message safely. In src/log.c, that already formatted buffer is subsequently passed to np2log() as the format string itself, causing vsyslog() to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using NETCONF-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. The advisory identifies 2.8.8 as patched; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.

Netopeer2 is a server for implementing network configuration management based on the NETCONF Protocol. In affected versions, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter whose text contains format specifiers. In src/netconf.c, np2srv_rpc_get_cb() sends the invalid value through ERR() to np2log_printf(), where vsnprintf() first formats the message safely. In src/log.c, that already formatted buffer is subsequently passed to np2log() as the format string itself, causing vsyslog() to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using NETCONF-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. The advisory identifies 2.8.8 as patched; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.