CVE-2020-11937: canonical whoopsie Uncontrolled Resource Consumption
Vulnerability summary
CVE-2020-11937 is a medium (CVSS 5.5) Uncontrolled Resource Consumption vulnerability in canonical whoopsie. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-08-2020PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In whoopsie, parse_report() from whoopsie.c allows a local attacker to cause a denial of service via a crafted file. The DoS is caused by resource exhaustion due to a memory leak. Fixed in 0.2.52.5ubuntu0.5, 0.2.62ubuntu0.5 and 0.2.69ubuntu0.1.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundWhoopsie Killer
Maturity: poc
Exploit Reference (launchpad.net)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Affected systems
Canonical1 product
- whoopsie≥ 0.2.52, < 0.2.52.5ubuntu0.5 | ≥ 0.2.62, < 0.2.62ubuntu0.5 | ≥ 0.2.69, < 0.2.69ubuntu0.1 | 0.2.66 | 0.2.67 | 0.2.68 | 0.2.69 | 0.2.49 | 0.2.50 | 0.2.51 | 0.2.52 | 0.2.52.1 | 0.2.52.2 | 0.2.52.3 | 0.2.52.4 | 0.2.52.5 | 0.2.52.5ubuntu0.1 | 0.2.52.5ubuntu0.2 | 0.2.52.5ubuntu0.3 | 0.2.52.5ubuntu0.4 | 0.2.58 | 0.2.59 | 0.2.59build1 | 0.2.60 | 0.2.61 | 0.2.62 | 0.2.62ubuntu0.1 | 0.2.62ubuntu0.2 | 0.2.62ubuntu0.3 | 0.2.62ubuntu0.4
Ubuntu1 product
- whoopsie< 0.2.52.5ubuntu0.5 | < 0.2.62ubuntu0.5 | < 0.2.69ubuntu0.1
2 vendors · 2 products