CVE-2011-10020

published 2025-08-20

CVE-2011-10020: Kaillera Server version 0.86 is vulnerable to a denial-of-service condition triggered by sending a malformed UDP packet after the initial handshake. Once a…

Priority P2 64 high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

EXPLOIT

Kaillera Server version 0.86 is vulnerable to a denial-of-service condition triggered by sending a malformed UDP packet after the initial handshake. Once a client sends a valid HELLO0.83 packet and receives a response, any subsequent malformed packet causes the server to crash and become unresponsive. This flaw stems from improper input validation in the server’s UDP packet handler, allowing unauthenticated remote attackers to disrupt service availability.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kaillera_project	server	<= 0.86	—

Detection & IOCs extracted from sources · hover to see the quote

command HELLO0.83↗

• → Detect exploitation attempts by monitoring for a UDP HELLO0.83 handshake packet to the Kaillera server followed immediately by a malformed/invalid UDP packet from the same source — this two-packet sequence is the attack pattern. ↗
• → Alert on unauthenticated remote UDP sessions to Kaillera server (default port) where the session begins with a valid HELLO0.83 packet but subsequent packets fail to conform to expected protocol structure. ↗

• · Vulnerability is specific to Kaillera Server version 0.86 only; other versions may not be affected. ↗
• · The attack requires no authentication — any unauthenticated remote attacker can trigger the crash after completing only the initial HELLO handshake, meaning network-level access controls are the primary mitigation surface. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20