Lldpd Project Lldpd vulnerabilities
6 vulnerabilities
Known vulnerabilities in Lldpd Project Lldpd, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-46433lldpd +7 morelldpd: Heap OOB Read in VLAN Decapsulation memmovelldpd is an implementation of IEEE 802.1ab (LLDP). Prior to version 1.0.22, lldpd_decode() in src/daemon/lldpd.c strips 802.1Q VLAN tags from received Ethernet frames by calling memmove() to shift the frame payload 4 bytes left. The third argument (byte count) is s - 2 * ETHER_ADDR_LEN but should be s - 2 * ETHER_ADDR_LEN - 4, causing a 4-byte heap buffer over-read past the malloc(h_mtu) allocation when the received frame size equals the interface MTU. This issue has been patched in version 1.0.22.CVSS6.5MediumEPSS0.22%PrioritiseCVE-2023-41910lldpd_project · lldpd +3 morelldpd_project lldpdAn issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.CVSS9.8CriticalEPSS1.15%PrioritiseCVE-2021-43612fedoraproject · fedora +5 morefedoraproject fedoraIn lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.CVSS7.5HighEPSS1.14%PrioritiseCVE-2020-27827fedoraproject · fedora +62 morefedoraproject fedoraA flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.CVSS7.5HighEPSS3.23%PrioritiseCVE-2015-8011debian · debian_linux +35 moredebian debian_linuxBuffer overflow in the lldp_decode function in daemon/protocols/lldp.c in lldpd before 0.8.0 allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via vectors involving large management addresses and TLV boundaries.CVSS9.8CriticalEPSS5.47%PrioritiseCVE-2015-8012lldpd_project · lldpd +2 morelldpd_project lldpdlldpd before 0.8.0 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via a malformed packet.CVSS7.5HighEPSS3.00%