{"schemaVersion":3,"id":"CVE-2025-30334","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"In OpenBSD 7.6 before errata 006 and OpenBSD 7.5 before errata 015, traffic sent over wg(4) could result in kernel crash.","dates":{"published":"2025-03-20T20:39:16.232Z","modified":"2025-03-21T15:22:01.218Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.1,"severity":"high","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":7.1,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":7.1,"severity":"high","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00446,"percentile":0.37401,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.016000000000000042,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0043},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0043,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0043,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0043,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0043,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0043,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0043,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00446,"percentile":0.37401}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0043,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00437,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00446,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00446,"percentile":0.37401}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-131","name":"Incorrect Calculation of Buffer Size","description":"The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/131.html"}],"affected":[{"vendor":"openbsd","product":"openbsd","name":"openbsd","label":"openbsd","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≥ 7.6, < 7.6 errata 006","noFixRecorded":false,"fixedIn":null},{"text":"≥ 7.5, < 7.5 errata 015","noFixRecorded":false,"fixedIn":null},{"text":"< 7.5","noFixRecorded":false,"fixedIn":null},{"text":"7.5","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_001","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_002","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_003","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_004","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_005","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_006","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_007","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_008","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_009","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_010","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_011","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_012","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_013","noFixRecorded":false,"fixedIn":null},{"text":"7.5:errata_014","noFixRecorded":false,"fixedIn":null},{"text":"7.6","noFixRecorded":false,"fixedIn":null},{"text":"7.6:errata_001","noFixRecorded":false,"fixedIn":null},{"text":"7.6:errata_002","noFixRecorded":false,"fixedIn":null},{"text":"7.6:errata_003","noFixRecorded":false,"fixedIn":null},{"text":"7.6:errata_004","noFixRecorded":false,"fixedIn":null},{"text":"7.6:errata_005","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 7.6, < 7.6 errata 006 | ≥ 7.5, < 7.5 errata 015 | < 7.5 | 7.5 | 7.5:errata_001 | 7.5:errata_002 | 7.5:errata_003 | 7.5:errata_004 | 7.5:errata_005 | 7.5:errata_006 | 7.5:errata_007 | 7.5:errata_008 | 7.5:errata_009 | 7.5:errata_010 | 7.5:errata_011 | 7.5:errata_012 | 7.5:errata_013 | 7.5:errata_014 | 7.6 | 7.6:errata_001 | 7.6:errata_002 | 7.6:errata_003 | 7.6:errata_004 | 7.6:errata_005","eol":{"isEol":true,"eolDate":"2025-04-28T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7.5","label":"7.5","eolFrom":"2025-04-28T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"openbsd","label":"OpenBSD","category":"os"}},"hubHref":"/vendor/openbsd/openbsd"}],"affectedCount":1,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/006_wg.patch.sig","label":"ftp.openbsd.org/pub/OpenBSD/patches/7.6/common/006_wg.patch.sig","hostname":"ftp.openbsd.org","tags":["Patch"]},{"url":"https://ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/015_wg.patch.sig","label":"ftp.openbsd.org/pub/OpenBSD/patches/7.5/common/015_wg.patch.sig","hostname":"ftp.openbsd.org","tags":["Patch"]},{"url":"https://github.com/openbsd/src/commit/c06199859734d958552a581d72b4c0f910e68d7c","label":"github.com/openbsd/src/commit/c06199859734d958552a581d72b4c0f910e68d7c","hostname":"github.com","tags":["Patch"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2025-03-20T20:39:16.232Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-03-21T15:22:01.218Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":28,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T16:04:55.143Z","stale":false,"partial":false}}