CVE-2025-67901: Medium severity OpenBSD openrsync vulnerability
openrsync through 0.5.0, as used in OpenBSD through 7.8 and on other platforms, allows a client to cause a server SIGSEGV by specifying a length of zero for block data, because the relationship between p->rem and p->len is not checked.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67901?
CVE-2025-67901 has a severity rating that indicates it can lead to a server crash due to SIGSEGV when a zero-length block data is specified.
How do I fix CVE-2025-67901?
To fix CVE-2025-67901, update to a version of openrsync that is higher than 0.5.0 where this vulnerability is patched.
Who is affected by CVE-2025-67901?
CVE-2025-67901 affects users of openrsync through version 0.5.0 and OpenBSD up to version 7.8.
What causes the vulnerability CVE-2025-67901?
CVE-2025-67901 is caused by the lack of validation between the remote pointer and the length of the block data, allowing a SIGSEGV to occur.
Is CVE-2025-67901 easily exploitable?
Yes, CVE-2025-67901 can be exploited by an attacker who can specify zero-length block data to the server.