{"id":"CVE-2010-3495","aliases":["EUVD-2010-0031","GHSA-j6m4-frxh-p4x8","PYSEC-2010-27"],"status":"published","title":"Zope Object Database Denial of Service vulnerability","description":"Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01336,"percentile":0.71423,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362"],"published":"2010-10-19T19:00:00Z","modified":"2026-06-16T23:22:53Z","fixes":[{"ecosystem":"PyPI","package":"zodb3","fixed_in":["3.10.0a2","3.10.0a1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"zodb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0a2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"zodb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0a2"}]}],"versions":["3.1.5","3.10.0a1","3.2.10","3.3.1","3.4.2","3.5.0","3.5.1","3.6.0","3.7.0","3.7.2","3.8.0","3.8.0a1","3.8.0b1","3.8.0b2","3.8.0b3","3.8.0b4","3.8.0c1","3.8.1","3.8.1b1","3.8.1b2","3.8.1b3","3.8.1b4","3.8.1b5","3.8.1b6","3.8.1b7","3.8.1b8","3.8.1b9","3.8.2","3.8.3","3.8.3b1","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0a1","3.9.0a10","3.9.0a11","3.9.0a12","3.9.0a2","3.9.0a3","3.9.0a4","3.9.0a5","3.9.0a6","3.9.0a7","3.9.0a9","3.9.0b1","3.9.0b2","3.9.0b3","3.9.0b4","3.9.0b5","3.9.0c1","3.9.0c2","3.9.0c3","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5","3.9.6","3.9.7"]},{"source":"osv","ecosystem":"PyPI","package":"zodb3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.0a1"}]}],"versions":["3.1.5","3.2.10","3.3.1","3.4.2","3.5.0","3.5.1","3.6.0","3.7.0","3.7.2","3.8.0","3.8.0a1","3.8.0b1","3.8.0b2","3.8.0b3","3.8.0b4","3.8.0c1","3.8.1","3.8.1b1","3.8.1b2","3.8.1b3","3.8.1b4","3.8.1b5","3.8.1b6","3.8.1b7","3.8.1b8","3.8.1b9","3.8.2","3.8.3","3.8.3b1","3.8.4","3.8.5","3.8.6","3.9.0","3.9.0a1","3.9.0a10","3.9.0a11","3.9.0a12","3.9.0a2","3.9.0a3","3.9.0a4","3.9.0a5","3.9.0a6","3.9.0a7","3.9.0a9","3.9.0b1","3.9.0b2","3.9.0b3","3.9.0b4","3.9.0b5","3.9.0c1","3.9.0c2","3.9.0c3","3.9.1","3.9.2","3.9.3","3.9.4","3.9.5","3.9.6","3.9.7"]}],"products":[{"vendor":"zope","product":"zodb"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2010/09/11/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://bugs.launchpad.net/zodb/+bug/135108","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://pypi.python.org/pypi/ZODB3/3.10.0#id1","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2010/09/24/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2010/09/22/3","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://bugs.python.org/issue6706","tags":["x_refsource_MISC","x_transferred","Patch","web"]},{"url":"http://www.openwall.com/lists/oss-security/2010/09/09/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://secunia.com/advisories/41755","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3495","tags":["advisory"]},{"url":"https://pypi.org/project/ZODB3/3.10.0a2/#a2-2010-05-04","tags":["web"]},{"url":"https://web.archive.org/web/20111225005929/http://secunia.com/advisories/41755","tags":["web"]},{"url":"https://github.com/zopefoundation/ZODB/commit/cfe16277ef1b5bb094dc79da50b0df1ee1537590","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/zodb3/PYSEC-2010-27.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j6m4-frxh-p4x8","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-3495","description":"Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.","status":"published","published":"2010-10-19T19:00:00Z","modified":"2024-08-07T03:11:44.31Z","updated_at":"2026-11-02T14:33:27.739358Z"}],"euvd":[{"id":"EUVD-2010-0031","description":"Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.","status":"published","published":"2010-10-19T19:00:00Z","modified":"2024-08-07T03:11:44Z","updated_at":"2026-11-03T01:39:34.48505Z"}],"ghsa":[{"id":"GHSA-j6m4-frxh-p4x8","title":"Zope Object Database Denial of Service vulnerability","description":"Race condition in `ZEO/StorageServer.py` in Zope Object Database (ZODB) before 3.10.0a2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.","status":"published","published":"2022-05-17T05:44:11Z","modified":"2024-11-19T19:02:37Z","cwes":["CWE-362"],"updated_at":"2026-11-02T14:38:21.777721Z"}],"nvd":[{"id":"CVE-2010-3495","description":"Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.","status":"published","published":"2010-10-19T20:00:04.377Z","modified":"2026-06-16T23:22:53.157Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:01:57.065463Z"}],"osv":[{"id":"GHSA-j6m4-frxh-p4x8","title":"Zope Object Database Denial of Service vulnerability","description":"Race condition in `ZEO/StorageServer.py` in Zope Object Database (ZODB) before 3.10.0a2 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.","status":"published","published":"2022-05-17T05:44:11Z","modified":"2024-11-30T05:27:03.725449Z","cwes":["CWE-362"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"PYSEC-2010-27","description":"Race condition in ZEO/StorageServer.py in Zope Object Database (ZODB) before 3.10.0 allows remote attackers to cause a denial of service (daemon outage) by establishing and then immediately closing a TCP connection, leading to the accept function having an unexpected return value of None, an unexpected value of None for the address, or an ECONNABORTED, EAGAIN, or EWOULDBLOCK error, a related issue to CVE-2010-3492.","status":"published","published":"2010-10-19T20:00:00Z","modified":"2026-06-10T17:00:28.50596759Z","updated_at":"2026-11-02T15:52:51.254177Z"}]}}