Skip to main content

rrdcached EUVDEUVD-2026-33726

| CVE-2026-43958 HIGH
Stack-based Buffer Overflow (CWE-121)
2026-06-01 redhat GHSA-pgh2-hfvj-4q69
7.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
7.8 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jun 01, 2026 - 19:23 vuln.today
CVE Published
Jun 01, 2026 - 17:34 nvd
HIGH 7.8

DescriptionCVE.org

A flaw was found in rrdcached, a component of rrdtool. A local attacker with access to a rrdcached socket can exploit a stack-based buffer overflow by sending an oversized CREATE request. This vulnerability can lead to a denial of service by crashing the daemon or potentially allow for arbitrary code execution, impacting the integrity and confidentiality of data.

AnalysisAI

Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to crash the daemon or potentially execute arbitrary code by sending an oversized CREATE request. The flaw is tracked under CWE-121 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L), reported by Red Hat against RHEL 6 through 10, and there is no public exploit identified at time of analysis.

Technical ContextAI

rrdcached is the data-caching daemon shipped with rrdtool, widely used to buffer writes to round-robin databases for monitoring stacks (Cacti, collectd, Munin, Observium, and similar). Clients communicate with rrdcached over a Unix or TCP socket using a simple line-oriented command protocol, including the CREATE command used to provision new RRD files. CWE-121 (Stack-Based Buffer Overflow) indicates that the daemon copies attacker-controlled input from a CREATE request into a fixed-size stack buffer without proper bounds checking, allowing the saved return address or adjacent stack data to be corrupted. The Red Hat-supplied CPEs cover Red Hat Enterprise Linux 6, 7, 8, 9, and 10, indicating the vulnerable code path is present across the long-supported RHEL releases that package rrdtool/rrdcached.

RemediationAI

No vendor-released patch version is identified in the supplied data; monitor the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-43958 and Bugzilla 2460932 and apply the rrdtool/rrdcached errata for your RHEL stream (6/7/8/9/10) as soon as they are released, then restart the rrdcached service. As compensating controls until patched, restrict access to the rrdcached socket: ensure the Unix socket path (typically under /var/run/rrdcached/) is owned by a dedicated service account with mode 0660 and not world-accessible, and avoid running rrdcached with the -l tcp listener - bind only to a Unix socket or to 127.0.0.1, and use a host firewall (firewalld/nftables) to block external access to the rrdcached TCP port if it must be enabled. Where feasible, run rrdcached under a confined SELinux domain and as an unprivileged service user to limit blast radius if code execution is achieved; the trade-off of restricting the socket is that remote collectors writing into rrdcached must be reconfigured to use a local agent or tunnel.

CVE-2026-4631 CRITICAL POC
9.8 Apr 07

Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h

CVE-2026-4480 CRITICAL POC
9.0 May 26

Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft

CVE-2026-14544 CRITICAL
9.8 Jul 03

Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter

CVE-2026-28369 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel

CVE-2026-28368 CRITICAL
9.1 Mar 27

HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls

CVE-2026-33845 CRITICAL
9.1 Apr 30

Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege

CVE-2026-28367 CRITICAL
9.1 Mar 27

HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator

CVE-2026-16526 HIGH
8.8 Jul 30

Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe

CVE-2026-11610 HIGH
8.8 Jul 07

Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD

CVE-2026-14474 HIGH
8.8 Jul 07

Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user

CVE-2026-52720 HIGH
8.8 Jun 15

Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co

CVE-2026-59851 HIGH
8.8 Jul 21

Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed
SUSE Linux Enterprise Server 16.0 Fixed

Share

EUVD-2026-33726 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy