What is the CVSS score of CVE-2026-4751?

CVE-2026-4751 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.0%.

Which versions of Debian are affected by CVE-2026-4751?

Organizations using NULL Pointer Dereference vulnerability in tmate-io tmate.This should be aware of moderate risk from CVE-2026-4751, a null pointer dereference vulnerability rated CVSS 5.3.. A patch is available.

How to fix or mitigate CVE-2026-4751?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Debian CVE-2026-4751

EUVD-2026-14768 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-03-24 GovTech CSG

GHSA-9g3x-ch5w-33ch

Denial Of Service Debian Null Pointer Dereference Suse

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 24, 2026 - 06:15 euvd

EUVD-2026-14768

Analysis Generated

Mar 24, 2026 - 06:15 vuln.today

Patch released

Mar 24, 2026 - 06:15 nvd

Patch available

CVE Published

Mar 24, 2026 - 05:37 nvd

MEDIUM 5.3

DescriptionCVE.org

NULL Pointer Dereference vulnerability in tmate-io tmate.This issue affects tmate: before 2.4.0.

AnalysisAI

A NULL pointer dereference vulnerability exists in tmate versions prior to 2.4.0, allowing unauthenticated remote attackers to cause a denial of service condition by crashing the application. The vulnerability has a CVSS score of 5.3 (medium severity) with low attack complexity and no privilege requirements, making it readily exploitable over the network. A patch is available from the vendor, and this issue does not compromise confidentiality or integrity-only availability.

Technical ContextAI

tmate is a terminal multiplexer and session sharing tool (CPE: cpe:2.3:a:tmate-io:tmate:*:*:*:*:*:*:*:*) that enables remote terminal access and collaboration. The vulnerability is classified as CWE-476 (NULL Pointer Dereference), a memory safety flaw where the application attempts to dereference a pointer that has not been properly initialized or validated. This occurs when tmate processes certain network inputs without adequate null-checks, likely in socket handling or session management code paths. The network-accessible nature (AV:N) and low attack complexity (AC:L) indicate the flaw is triggered by standard network input without requiring special conditions or authentication (PR:N).

RemediationAI

Upgrade tmate to version 2.4.0 or later, which includes the NULL pointer dereference fix. Users can obtain the patched version from the official tmate GitHub repository (https://github.com/tmate-io/tmate) or through their distribution's package manager if available. For environments where immediate patching is not feasible, restrict network access to tmate services using firewall rules or network segmentation to limit exposure to trusted internal hosts only. Additionally, monitor process stability and implement automated restart mechanisms to minimize downtime from potential crashes pending patch deployment.