Solanum
Monthly
Memory corruption in Solanum IRCd's server-to-server KILL handler (ms_kill) lets an attacker who controls a linked peer server crash the ircd and potentially execute code by sending a kill reason longer than KILLLEN, which overflows a static 512-byte buffer. Only builds prior to commit 2ea1382 are affected, and the flaw is not reachable by ordinary IRC clients - the attacker must already hold an established, trusted server-to-server link (the CVSS 4.0 vector rates PR:H for this reason). A vendor patch exists via PR #550 / commit 2ea1382, and no public exploit code was identified at the time of analysis.
Heap-based memory corruption in the Solanum IRC daemon (builds from before commit 2ce64de) lets a malicious linked server corrupt process memory by sending JOIN or SJOIN messages whose channel names exceed CHANNELLEN, crashing the ircd and potentially yielding remote code execution. The flaw sits on the server-to-server path of a federated network: the attacker must already control a server that is peered into the target Solanum network, so ordinary unauthenticated IRC clients cannot reach it, and the assessed CVSS 3.1 vector (PR:H) reflects that gating. No public exploit identified at time of analysis; the upstream fix is available as a commit and pull request rather than a confirmed tagged release, and the priority signal places it in this_week rather than an emergency tier.
Memory corruption in Solanum IRCd's server-to-server KILL handler (ms_kill) lets an attacker who controls a linked peer server crash the ircd and potentially execute code by sending a kill reason longer than KILLLEN, which overflows a static 512-byte buffer. Only builds prior to commit 2ea1382 are affected, and the flaw is not reachable by ordinary IRC clients - the attacker must already hold an established, trusted server-to-server link (the CVSS 4.0 vector rates PR:H for this reason). A vendor patch exists via PR #550 / commit 2ea1382, and no public exploit code was identified at the time of analysis.
Heap-based memory corruption in the Solanum IRC daemon (builds from before commit 2ce64de) lets a malicious linked server corrupt process memory by sending JOIN or SJOIN messages whose channel names exceed CHANNELLEN, crashing the ircd and potentially yielding remote code execution. The flaw sits on the server-to-server path of a federated network: the attacker must already control a server that is peered into the target Solanum network, so ordinary unauthenticated IRC clients cannot reach it, and the assessed CVSS 3.1 vector (PR:H) reflects that gating. No public exploit identified at time of analysis; the upstream fix is available as a commit and pull request rather than a confirmed tagged release, and the priority signal places it in this_week rather than an emergency tier.