CVE-2023-52557: OpenBSD

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

In OpenBSD 7.3 before errata 016, npppd(8) could crash by a l2tp message which has an AVP (Attribute-Value Pair) with wrong length.

Affected products

• OpenBSD OpenBSD: before 7.3 (fixed in 7.3); version 7.3 only

Published 2024-03-01. Last modified 2026-06-17.