Description
Off-by-one error in the process_cgivars function in contrib/daemonchk.c in Nagios Core 3.5.1, 4.0.2, and earlier allows remote authenticated users to obtain sensitive information from process memory or cause a denial of service (crash) via a long string in the last key value in the variable list, which triggers a heap-based buffer over-read.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | nagios3 | 3.5.1.dfsg-2+deb8u1 | DLA-1615-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | nagios3 | 3.5.1.dfsg-2.1ubuntu1.1 | USN-3253-1 |
| Ubuntu 14.04 LTS | nagios3 | 3.5.1-1ubuntu1.1 | USN-3253-1 |
Advisories 2
- DLA-1615-1 nagios3 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-3253-1 nagios3 vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- 64489 vdb-entry
- MDVSA-2014:004 vendor-advisory
- http://sourceforge.net/p/nagios/nagioscore/ci/d97e03f32741a7d851826b03ed73ff4c9612a866/
- [debian-lts-announce] 20181224 [SECURITY] [DLA 1615-1] nagios3 security update mailing-list
- [oss-security] 20131224 Re: CVE request: denial of service in Nagios (process_cgivars()) mailing-list
- 55976 third-party-advisory