Inetutils vulnerabilities

5 known vulnerabilities in Inetutils from GNU. 5 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  inetutils: Buffer Copy without Checking Size of Input

  CVE-2026-32746Mar 13, 2026GNUEPSS 45.3%

  telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

• 7.8 High severity

  inetutils: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2026-28372Feb 27, 2026GNU

  telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added to the login(1) implementation of util-linux in release 2.40. This is related to client control over the CREDENTIALS_DIR

• 9.8 Critical severity

  GNU InetUtils Argument Injection Exploited

  CVE-2026-24061Jan 21, 2026GNUEPSS 99%

  telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

• 7.8 High severity

  Inetutils: Unchecked Return Value

  CVE-2023-40303Aug 14, 2023GNU

  GNU inetutils before 2.5 may allow privilege escalation because of unchecked return values of set*id() family functions in ftpd, rcp, rlogin, rsh, rshd, and uucpd. This is, for example, relevant if the setuid system call fails when a process is trying to drop

• 7.5 High severity

  Inetutils: NULL Pointer Dereference

  CVE-2022-39028Aug 30, 2022GNUEPSS 2.35%

  telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available thro