GCVE - cpe:2.3:a:collectd:collectd:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:collectd:collectd:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Collectd (`5db9078f-8e96-5376-ac15-cf69ff312a7e`)
Product	Collectd (`1c7cceb2-5fd5-530e-8a25-68905402efed`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/collectd`	purl2cpe	2026-06-01 10:15:49.740573
`pkg:deb/ubuntu/collectd`	purl2cpe	2026-06-01 10:15:49.740576
`pkg:github/collectd/collectd`	purl2cpe	2026-06-01 10:15:49.740579
`pkg:rpm/fedora/collectd`	purl2cpe	2026-06-01 10:15:49.740582
`pkg:rpm/opensuse/collectd`	purl2cpe	2026-06-01 10:15:49.740585

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7401`	vulnerable	2026-06-08 05:09:55.850936	Details available Incorrect interaction of the parse_packet() and parse_part_sign_sha256() functions in network.c in collectd 5.7.1 and earlier allows remote attackers to cause a denial of service (infinite loop) of a collectd instance (configured with "SecurityLevel None" and with empty "AuthFile" options) via a crafted UDP packet. Published: 2017-04-03T14:00:00.000Z Updated: 2024-08-05T16:04:10.585Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/97321 https://access.redhat.com/errata/RHSA-2017:1285 https://github.com/collectd/collectd/issues/2174 https://access.redhat.com/errata/RHSA-2018:2615 https://access.redhat.com/errata/RHSA-2017:1787	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-18240`	vulnerable	2026-06-08 05:09:10.622457	Details available The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL (when the service is stopped). Published: 2018-03-19T02:00:00.000Z Updated: 2024-08-05T21:13:49.150Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201803-10 http://www.securityfocus.com/bid/103469 https://bugs.gentoo.org/628540	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16820`	vulnerable	2026-06-08 05:09:01.099778	Details available The csnmp_read_table function in snmp.c in the SNMP plugin in collectd before 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash (or potentially have other impact). Published: 2017-11-14T21:00:00.000Z Updated: 2024-08-05T20:35:21.026Z Open on db.gcve.eu Reference links https://access.redhat.com/errata/RHSA-2018:0252 https://security.gentoo.org/glsa/201803-10 https://bugs.debian.org/881757 https://github.com/collectd/collectd/issues/2291 https://access.redhat.com/errata/RHSA-2018:0560	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-6254`	vulnerable	2026-06-08 05:07:59.279946	Details available Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet. Published: 2016-08-19T21:00:00.000Z Updated: 2024-08-06T01:22:20.649Z Open on db.gcve.eu Reference links https://github.com/collectd/collectd/commit/b589096f907052b3a4da2b9ccc9b0e2e888dfc18 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UIZ5UXDOB7BA5NGE2F2I2BL4K6763DHW/ http://www.debian.org/security/2016/dsa-3636 http://collectd.org/news.shtml https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CM4W5SJ4OTBGINGIN4NJLXCUZAZANO6J/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Collectd

Notes

PURL mappings

Vulnerability references

Contribute