Summary
It was discovered that the Inetutils telnet daemon incorrectly handled
the CREDENTIALS_DIRECTORY environment variable. An attacker could possibly
use this issue to escalate privileges. (CVE-2026-28372)
It was discovered that the Inetutils telnet daemon did not properly
validate buffer bounds when processing LINEMODE SLC suboptions. An attacker
could possibly use this issue to cause a denial of service or execute
arbitrary code. (CVE-2026-32746)
It was discovered that the Inetutils telnet client incorrectly handled the
NEW_ENVIRON SEND USERVAR option. An attacker could possibly use this issue
to read arbitrary environment variables. (CVE-2026-32772)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | inetutils | 2:2.5-3ubuntu4.2 |
| Ubuntu · 25.10 | inetutils | 2:2.6-1ubuntu3.2 |
| Ubuntu · 26.04 LTS 26.04:LTS | inetutils | 2:2.7-2ubuntu1.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | inetutils | 2:1.9.2-1ubuntu0.1~esm4 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | inetutils | 2:1.9.4-1ubuntu0.1~esm6 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | inetutils | 2:1.9.4-3ubuntu0.1+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | inetutils | 2:1.9.4-11ubuntu0.2+esm4 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | inetutils | 2:2.2-2ubuntu0.2+esm1 |
Vulnerabilities 3
-
Critical 9.8
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption…
-
High 7.4CVE-2026-28372 Public exploit
telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service crede…
-
Low 3.4
telnet in GNU inetutils through 2.7 allows servers to read arbitrary environment variables from clients via NEW_ENVIRON…