CVE-2026-32746
published 2026-03-13CVE-2026-32746: telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check…
PriorityP277critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
44.10%
98.7th percentile
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | inetutils | < inetutils 2:2.4-2+deb12u3 (bookworm) | inetutils 2:2.4-2+deb12u3 (bookworm) |
| gnu | inetutils | <= 2.7 | — |
| gnu | inetutils | >= 0 < 2:2.4-2+deb12u3 | 2:2.4-2+deb12u3 |
| gnu | inetutils | >= 0 < 2:2.6-3+deb13u3 | 2:2.6-3+deb13u3 |
| gnu | inetutils | >= 0 < 2:2.7-4 | 2:2.7-4 |
| ubuntu | inetutils | — | — |
| vllm | vllm | >= 0.15.1 < 0.17.0 | 0.17.0 |
Detection & IOCsextracted from sources · hover to see the quote
snort↗
alert telnet any any -> $HOME_NET any (msg:"ET EXPLOIT Telnet SLC Option Data Buffer Overflow Attempt (CVE-2026-32746)"; flow:established,to_server; content:"|ff fa 22|"; fast_pattern; content:"|ff f0|"; distance:109; reference:url,labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746/; reference:cve,2026-32746; classtype:web-application-attack; sid:2068415; rev:1; metadata:affected_product telnetd, attack_target Server, tls_state plaintext, created_at 2026_03_25, cve CVE_2026_32746, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_03_25, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
bytes↗
|ff fa 22| ... |ff f0| (IAC SB LINEMODE ... IAC SE, distance:109)
- →The overflow occurs when more than ~34 SLC triplets are sent in a single LINEMODE SLC suboption. Each triplet is 3 bytes; the usable buffer is 104 bytes (108-byte slcbuf minus 4-byte header). Alert on LINEMODE SLC suboptions whose body exceeds 104 bytes (i.e., IAC SE appears more than 109 bytes after IAC SB LINEMODE). ↗
- →SLC function codes greater than NSLC (18 / 0x12) in a LINEMODE suboption are the specific trigger for the vulnerable add_slc() code path. Inspect SLC triplet function bytes; values above 0x12 in a LINEMODE SB are anomalous and attack-indicative. ↗
- →The Snort/Suricata ET rule (sid:2068415) detects the exploit by matching IAC SB LINEMODE (|ff fa 22|) followed by IAC SE (|ff f0|) at a distance of 109 bytes, which places the SE beyond the safe buffer boundary. ↗
- →A public PoC and Docker lab environment exist (github.com/jeffaf/cve-2026-32746), and Wiz confirms a public exploit exists. Treat any telnetd ≤ 2.7 exposure as actively exploitable. ↗
- ·Debian 11 (bullseye) has no fix available as of the advisory date; only Debian 12/13/14 and sid have patches. Systems on bullseye remain vulnerable and cannot be patched via standard package update. ↗
- ·The ET Snort rule uses distance:109 (not within:), meaning it will match IAC SE anywhere beyond 109 bytes after IAC SB LINEMODE. Tune for your environment to reduce false positives on legitimate but large LINEMODE negotiations. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_ubuntu7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Inetutils vulnerabilities
vendor_ubuntu·2026-06-04·CVSS 7.8
CVE-2026-32746 [HIGH] Inetutils vulnerabilities
Title: Inetutils vulnerabilities
Summary: Several security issues were fixed in Inetutils.
It was discovered that the Inetutils telnet daemon incorrectly handled
the CREDENTIALS_DIRECTORY environment variable. An attacker could possibly
use this issue to escalate privileges. (CVE-2026-28372)
It was discovered that the Inetutils telnet daemon did not properly
validate buffer bounds when processing LINEMODE SLC suboptions. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-32746)
It was discovered that the Inetutils telnet client incorrectly handled the
NEW_ENVIRON SEND USERVAR option. An attacker could possibly use this issue
to read arbitrary environment variables. (CVE-2026-32772)
Instructions: In general, a standard system upd
Debian
CVE-2026-32746: inetutils - telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMO...
vendor_debian·2026·CVSS 9.8
CVE-2026-32746 [CRITICAL] CVE-2026-32746: inetutils - telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMO...
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
Scope: local
bookworm: resolved (fixed in 2:2.4-2+deb12u3)
bullseye: open
forky: resolved (fixed in 2:2.7-4)
sid: resolved (fixed in 2:2.7-4)
trixie: resolved (fixed in 2:2.6-3+deb13u3)
GHSA
GHSA-qvfm-56cp-4988: telnetd in GNU inetutils through 2
ghsa_unreviewed·2026-03-13
CVE-2026-32746 [CRITICAL] CWE-120 GHSA-qvfm-56cp-4988: telnetd in GNU inetutils through 2
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
OSV
CVE-2026-32746: telnetd in GNU inetutils through 2
osv·2026-03-13·CVSS 9.8
CVE-2026-32746 [CRITICAL] CVE-2026-32746: telnetd in GNU inetutils through 2
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
GHSA
vLLM has SSRF Protection Bypass
ghsa·2026-03-09
CVE-2026-25960 [MEDIUM] CWE-918 vLLM has SSRF Protection Bypass
vLLM has SSRF Protection Bypass
## Summary
The SSRF protection fix for https://github.com/vllm-project/vllm/security/advisories/GHSA-qh4c-xf7m-gxfc can be bypassed in the `load_from_url_async` method due to inconsistent URL parsing behavior between the validation layer and the actual HTTP client.
## Affected Component
- **File**: `vllm/connections.py`
- **Function**: `load_from_url_async`
## Vulnerability Details
### Root Cause
The SSRF [fix](https://github.com/vllm-project/vllm/pull/32746) uses `urllib3.util.parse_url()` to validate and extract the hostname from user-provided URLs. However, `load_from_url_async` uses `aiohttp` for making the actual HTTP requests, and `aiohttp` internally uses the `yarl` library for URL parsing.
These two URL parsers handle backslash characters (`\
Suricata
ET EXPLOIT Telnet SLC Option Data Buffer Overflow Attempt (CVE-2026-32746)
suricata·2026-03-25·CVSS 9.8
CVE-2026-32746 [CRITICAL] ET EXPLOIT Telnet SLC Option Data Buffer Overflow Attempt (CVE-2026-32746)
ET EXPLOIT Telnet SLC Option Data Buffer Overflow Attempt (CVE-2026-32746)
Rule: alert telnet any any -> $HOME_NET any (msg:"ET EXPLOIT Telnet SLC Option Data Buffer Overflow Attempt (CVE-2026-32746)"; flow:established,to_server; content:"|ff fa 22|"; fast_pattern; content:"|ff f0|"; distance:109; reference:url,labs.watchtowr.com/a-32-year-old-bug-walks-into-a-telnet-server-gnu-inetutils-telnetd-cve-2026-32746/; reference:cve,2026-32746; classtype:web-application-attack; sid:2068415; rev:1; metadata:affected_product telnetd, attack_target Server, tls_state plaintext, created_at 2026_03_25, cve CVE_2026_32746, deployment Perimeter, deployment Internal, performance_impact Low, confidence Medium, signature_severity Major, tag Exploit, updated_at 2026_03_25, mitre_tactic_id TA0001, mitre_tact
Hackernews
⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
blogs_hackernews·2026-03-30·CVSS 9.3
[CRITICAL] ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Telecom Sleeper Cells, LLM Jailbreaks, Apple Forces U.K. Age Checks and More
Some weeks are loud. This one was quieter but not in a good way. Long-running operations are finally hitting courtrooms, old attack methods are showing up in new places, and research that stopped being theoretical right around the time defenders stopped paying attention.
There's a bit of everything this week. Persistence plays, legal wins, influence ops, and at least one thing that looks boring until you see what it connects to.
All of it below. Let's go.
## ⚡ Threat of the Week
Citrix Flaw Comes Under Active Exploitation — A cr
Hackernews
⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More
blogs_hackernews·2026-03-23
⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: CI/CD Backdoor, FBI Buys Location Data, WhatsApp Ditches Numbers & More
Another week, another reminder that the internet is still a mess. Systems people thought were secure are being broken in simple ways, showing many still ignore basic advisories.
This edition covers a mix of issues: supply chain attacks hitting CI/CD setups, long-abused IoT devices being shut down, and exploits moving quickly from disclosure to real attacks. There are also new malware tricks showing attackers are becoming more patient and creative.
It’s a mix of old problems that never go away and new methods that are harder to detect. Th
Checkpoint
23rd March – Threat Intelligence Report
blogs_checkpoint·2026-03-23
CVE-2026-33017 23rd March – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 23rd March – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 23rd March, please download our Threat Intelligence Bulletin.
TOP ATTACKS AND BREACHES
Navia Benefit Solutions, a United States-based employee benefits administrator, has disclosed a breach affecting more than 2.6 million individuals after unauthorized access and potential data exfiltration occurred between December 22, 2025 and January 15, 2026. Exposed information may include personal, health, and benefits dat
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
Wiz
CVE-2026-32772 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-32772 [HIGH] CVE-2026-32772 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32772 :
GNU InetUtils Telnet vulnerability analysis and mitigation
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON SEND USERVAR.
Source : NVD
## 3.4
Score
Published March 16, 2026
Severity LOW
CNA Score 3.4
Affected Technologies
GNU InetUtils Telnet
Linux Debian
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 8.5
Exploitation Probability (EPSS) N/A
Affected packages and libraries
inetutils
cpe:2.3:a:gnu:inetutils
Sources
NVD
Debian 11 Severity LOW No Fix Added at: Mar 14, 2026
Debian 12, 13, 14 Severity LOW Has Fix Added at: Mar 14, 2026
Echo Severity LOW Has Fix Added at: Mar 14, 2026
Linux
Wiz
CVE-2026-32746 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 7.8
CVE-2026-32746 [HIGH] CVE-2026-32746 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-32746 :
GNU InetUtils Telnet vulnerability analysis and mitigation
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
Source : NVD
## 9.8
Score
Published March 13, 2026
Severity CRITICAL
CNA Score 9.8
High-profile Vulnerability Yes
Affected Technologies
GNU InetUtils Telnet
Linux Debian
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 7.6
Exploitation Probability (EPSS) N/A
Affected packages and libraries
krb5-appl-clients
krb5-appl-servers
Sources
Debian 11 Severity CRITICAL No Fix Added at: Mar 14, 2026
Debian 12, 13, 14 Severity
2026-03-13
Published