A 32-Year-Old Telnet Bug Exposes Millions to Pre-Auth RCE
A 32-Year-Old Bug Walks into a Telnet Server
CVE-2026-32746 is a buffer overflow in GNU inetutils telnetd's LINEMODE SLC handler, allowing attackers to corrupt about 400 bytes of adjacent memory without authentication. The flaw dates back to 1994 and has been copy-pasted into Ubuntu, Debian, FreeBSD, NetBSD, Citrix NetScaler, macOS, and more. Exploitation is tricky due to input restrictions, but the blast radius is vast.
The server will duly store all these values in a global array of a fixed size, without doing any bounds checking. Wait, what?! Yes, that’s the vulnerability. Undetected since 1994, people.
- collinfunk
As the person who wrote the fix for this issue (and not the original code), I will just mention that I find this paragraph makes the author sound incredibly entitled:
Shamefully, the inetutils project hasn’t actually released a fixed version of their software (at least at the time of publishing).
The bug was reported on a public mailing list, which is sadly common nowadays [1]. After my workday, during which I was not able to review the report, I wrote a script to confirm the bug was real, since I was seeing way too many slop reports at the time. Then I sent a patch before going to bed [2]. A third party then graciously shared the patch on oss-security [3], which all distributions follow. There is no need to make a new release, which is harder for the distributions than simply applying a small patch.
Perhaps I am just unlucky in my interactions, but I feel like this entitlement is too common among software security people. Note that I see zero return in spending time working on Inetutils, and I find other projects I work on more interesting.
[1] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg...
[2] https://lists.gnu.org/archive/html/bug-inetutils/2026-03/msg...
[3] https://www.openwall.com/lists/oss-security/2026/03/12/4
- b800h
> "1994"
> "RISC was a distant dream"
Ahem
- krautsauer
Needs a (March 19)
(I know HN only does this for years, but this being about vulnerabilities…)
- notimetorelax
I really dislike articles that blow out of proportion the technical details. TLDR; bounds checking was missing leading to potential memory corruption.
- sjpb
If you're going to rip off xkcd pictures, I feel it'd be polite at least credit and/or link the original.