CVE-2026-32772: GNU InetUtils

Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days.

telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.

Affected products

• GNU InetUtils: up to and including 2.7

Published 2026-03-16. Last modified 2026-06-17.