GNU InetUtils vulnerabilities

8 CVEs affecting GNU InetUtils, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-32772, published 2026-03-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability, published 2026-01-21. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-01-26. EPSS: 99% chance of exploitation in the next 30 days. telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
CVE-2011-4862, published 2011-12-25. High severity, CVSS 10.0. EPSS: 95.1% chance of exploitation in the next 30 days. Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and…
CVE-2026-32746, published 2026-03-13. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2022-39028, published 2022-08-30. High severity, CVSS 7.5. EPSS: 2.1% chance of exploitation in the next 30 days. telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application…
CVE-2021-40491, published 2021-09-03. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. The ftp client in GNU Inetutils before 2.2 does not validate addresses returned by PASV/LSPV responses to make sure they match the server address. This is similar to CVE-2020-8284 for curl.
CVE-2023-40303, published 2023-08-14. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if…
CVE-2026-32772, published 2026-03-16. Medium severity, CVSS 4.7. EPSS: 0.3% chance of exploitation in the next 30 days. telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
CVE-2026-28372, published 2026-02-27. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release…