Description
The cu_rrd_create_file function (src/utils_rrdcreate.c) in collectd 4.x before 4.9.4 and before 4.10.2 allow remote attackers to cause a denial of service (assertion failure) via a packet with a timestamp whose value is 10 or less, as demonstrated by creating RRD files using the (1) RRDtool and (2) RRDCacheD plugins.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 13 | collectd | 4.10.1-2.1 | — |
| Debian 12 | collectd | 4.10.1-2.1 | — |
| Debian 5.0 | collectd | 4.4.2-3+lenny1 | DSA-2133-1 |
Advisories 1
- DSA-2133-1 collectd - denial of service Debian Security (DSA / DLA) · Mar 9, 2026
References
- SUSE-SR:2011:009 vendor-advisory
- 42491 third-party-advisory
- DSA-2133 vendor-advisory
- 42846 third-party-advisory
- ADV-2011-0041 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=605092
- FEDORA-2010-19031 vendor-advisory
- ADV-2010-3196 vdb-entry
- http://collectd.org/news.shtml#news86
- 45075 vdb-entry
- 42393 third-party-advisory