CVE-2026-32772: Medium severity GNU InetUtils vulnerability
Last updated 8 June 2026
Other sources
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEWENVIRON SEND USERVAR.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/inetutilsto a version that resolves this vulnerability.Fixed in 2:2.0-1+deb11u4Fixed in 2:2.4-2+deb12u3Fixed in 2:2.6-3+deb13u3Fixed in 2:2.8-2 - Upgrade
Upgrade
alpine/inetutils-telnetto a version that resolves this vulnerability.Fixed in 2.8-r0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32772?
CVE-2026-32772 has been classified as a medium severity vulnerability due to the potential for arbitrary environment variable exposure.
How do I fix CVE-2026-32772?
To fix CVE-2026-32772, upgrade to GNU inetutils version 2.8 or later, which addresses this vulnerability.
What impact does CVE-2026-32772 have on security?
CVE-2026-32772 allows remote attackers to read sensitive environment variables from clients, which may lead to further exploitation.
Is CVE-2026-32772 exploitable remotely?
Yes, CVE-2026-32772 is exploitable remotely since it affects the telnet service that can be accessed over a network.
What versions of GNU inetutils are affected by CVE-2026-32772?
CVE-2026-32772 affects GNU inetutils versions up to and including 2.7.