Description
An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can remotely force the lldpd daemon to perform an out-of-bounds read on heap memory. This occurs in cdp_decode in daemon/protocols/cdp.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | lldpd | 1.0.17-1 | — |
| Debian 13 | lldpd | 1.0.17-1 | — |
| Debian 12 | lldpd | 1.0.16-1+deb12u1 | DSA-5505-1 |
| Debian 11 | lldpd | 1.0.11-1+deb11u2 | DSA-5505-1 |
| Debian 10 | lldpd | 1.0.3-1+deb10u2 | DLA-3578-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | lldpd | No fix yet | — |
| Ubuntu 20.04 LTS | lldpd | No fix yet | — |
| Ubuntu 18.04 LTS | lldpd | No fix yet | — |
| Ubuntu 16.04 LTS | lldpd | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | lldpd +1 | 1.0.18-4.el9 | RHSA-2024:9158 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | lldpd +1 | 1.0.18-4.el9 | ALSA-2024:9158 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | lldpd | 1.0.18-4.el9 | RLSA-2024:9158 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | lldpd | 1.0.23-1.1 | openSUSE-SU-2026:12272-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | lldpd | 1.0.14-3 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | lldpd +1 | 1.0.18-4.el9 | ELSA-2024-9158 |
Advisories 12
- ALSA-2024:9158 Moderate: lldpd security update AlmaLinux Security Advisories · Oct 29, 2026
- openSUSE-SU-2026:12272-1 liblldpctl4-1.0.23-1.1 on GA media SUSE / openSUSE Security Updates · Oct 27, 2026
- RHSA-2024:9158 Red Hat Security Advisory: lldpd security update Red Hat Security Advisories (RHSA) · Aug 7, 2026
- DSA-5505-1 lldpd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3578-1 lldpd - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2024:9158 Moderate: lldpd security update Rocky Linux Security Advisories · Feb 5, 2026
- ELSA-2024-9158 Moderate: lldpd security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Nov 14, 2024
- ICSA-24-165-06 Siemens TIM 1531 IRC CISA ICS & IT advisories · Jul 9, 2024
- SSA-337522 SSA-337522: Multiple Vulnerabilities in TIM 1531 IRC before V2.4.8 Siemens ProductCERT · Jul 9, 2024
- NCSC-2024-0246 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Jun 11, 2024
- SSA-625862 SSA-625862: Multiple Vulnerabilities in Third-Party Components in SIMATIC CP 1542SP-1 and CP 1543SP-1 before V2.3 Siemens ProductCERT · Jun 11, 2024
- ICSA-24-165-10 Siemens SIMATIC and SIPLUS CISA ICS & IT advisories · Jun 11, 2024