CVE-2020-8244: Bufferlist Project Bufferlist

Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days.

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Affected products

• Bufferlist Project Bufferlist: before 1.2.3 (fixed in 1.2.3); from 2.0.0, before 2.2.1 (fixed in 2.2.1); from 3.0.0, before 3.0.1 (fixed in 3.0.1); from 4.0.0, before 4.0.3 (fixed in 4.0.3)
• Debian Debian Linux: version 9.0 only

Published 2020-08-30. Last modified 2026-06-17.