CVE-2020-13111

HIGH 7.5CVE-2020-13111 · Published 16/05/2020 · updated 17/06/2026

In short

CVE-2020-13111 is a HIGH (CVSS 7.5) vulnerability affecting naviserver (naviserver project).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 73.3% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
naviserver naviserver_project	`≥ 4.99.4, ≤ 4.99.19`	No fix yet

Description

NaviServer 4.99.4 to 4.99.19 allows denial of service due to the nsd/driver.c ChunkedDecode function not properly validating the length of a chunk. A remote attacker can craft a chunked-transfer request that will result in a negative value being passed to memmove via the size parameter, causing the process to crash.

References

bitbucket.org/naviserver/naviserver/commits/a5c3079f1d8996d5f34c9384a440acf3519ca3bb · Patch
sourceforge.net/p/naviserver/bugs/89 · Permissions Required

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free