CVE-2026-43958

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

• rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

• rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

• rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

• rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

• rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

• rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.

• CVE-2026-43958: fix stack buffer overflow in rrdcached CREATE request handler

• CVE-2026-43958: fix stack buffer overflow in rrdcached CREATE request handler

• CVE-2026-43958: fix stack buffer overflow in rrdcached CREATE request handler

• CVE-2026-43958: fix stack-based buffer overflow in rrdcached handle_request_create() via an oversized CREATE request with unbounded DS/RRA arguments

• CVE-2026-43958: fix stack-based buffer overflow in rrdcached handle_request_create() via an oversized CREATE request with unbounded DS/RRA arguments

• SECURITY UPDATE: stack-based buffer overflow in rrdcached CREATE request handling
  • debian/patches/CVE-2026-43958.patch: bound the av[] argument array in handle_request_create() so an oversized CREATE request with more than 128 DS:/RRA: definitions can no longer overflow the stack buffer, plus the accompanying upstream hardening in rrd_xport, rrd_graph, rrd_graph_helper and rrd_daemon. The rrd_xport fill loop uses the index-based bounds check from upstream follow-up a8174e6a rather than the timestamp comparison it originally shipped with.
  • CVE-2026-43958

• SECURITY UPDATE: add safety guards for NULL, bounds, and zero-division checks
  • debian/patches/CVE-2026-43958.patch: add NULL, bounds, and zero-division safety checks in rrd_xport.c, rrd_graph.c, rrd_graph_helper.c and rrd_daemon.c
  • CVE-2026-43958

These are all security issues fixed in the librrd8-1.10.3-1.1 package on the GA media of openSUSE Tumbleweed.

This update for rrdtool fixes the following issue:

• CVE-2026-43958: stack buffer overflow in rrdcached handle_request_create() can lead to local privilege escalation via unbounded DS/RRA arguments (bsc#1267243).

This update for rrdtool fixes the following issue:

• CVE-2026-43958: stack buffer overflow in rrdcached handle_request_create() can lead to local privilege escalation via unbounded DS/RRA arguments (bsc#1267243).

This update for rrdtool fixes the following issue:

• CVE-2026-43958: stack buffer overflow in rrdcached handle_request_create() can lead to local privilege escalation via unbounded DS/RRA arguments (bsc#1267243).

This update for rrdtool fixes the following issue

• CVE-2026-43958: stack buffer overflow in rrdcached handle_request_create() can lead to local privilege escalation via unbounded DS/RRA arguments (bsc#1267243).

This update for rrdtool fixes the following issue:

• CVE-2026-43958: stack buffer overflow in rrdcached handle_request_create() can lead to local privilege escalation via unbounded DS/RRA arguments (bsc#1267243).