{"id":"CVE-2026-63201","kind":"vulnerability","aliases":["CVE-2026-63201"],"related":[],"title":"Netopeer2: crafted get request crashes NETCONF server via format strings","description":"Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.","summary":"Netopeer2 is a NETCONF server used for network configuration management. A low-privileged authenticated user can send a get request with a crafted subtree filter that makes netopeer2-server crash, a denial of service.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["netconf","netopeer2","network-automation","runtime"],"not_affected_if":["netconf-not-exposed","netopeer2-not-installed"],"how_to_check":"- Find the installed Netopeer2 version and compare it with the fixed versions listed below\n- Confirm whether netopeer2-server accepts NETCONF-over-SSH sessions from users who are not administrators\n- Sources do not give a specific command or file path to run this check","fix":"- Netopeer2 `2.8.21` (fix verified by repository comparison)\n- The advisory names `2.8.8` as patched, but no public `2.8.8` tag was located, so an untagged 2.8.8 build is unverified","status":"open","published_at":"2026-10-30T22:16:58+00:00","first_seen_at":"2026-10-30T22:25:57+00:00","triaged_at":"2026-10-30T22:27:18+00:00","updated_at":"2026-10-30T22:27:18+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-30T22:27:18Z","model":"claude-haiku-5-5","output":{"fix":"- Netopeer2 `2.8.21` (fix verified by repository comparison)\n- The advisory names `2.8.8` as patched, but no public `2.8.8` tag was located, so an untagged 2.8.8 build is unverified","reach":"network","title":"Netopeer2: crafted get request crashes NETCONF server via format strings","impact":"medium","summary":"Netopeer2 is a NETCONF server used for network configuration management. A low-privileged authenticated user can send a get request with a crafted subtree filter that makes netopeer2-server crash, a denial of service.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["netopeer2","netconf","network-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Server crash by authenticated user; code execution not confirmed","analyst_note":"Resolve the affected/fixed boundary at 2.8.8: advisory says patched, repository comparison only verifies 2.8.21. See https://nvd.nist.gov/vuln/detail/CVE-2026-63201","how_to_check":"- Find the installed Netopeer2 version and compare it with the fixed versions listed below\n- Confirm whether netopeer2-server accepts NETCONF-over-SSH sessions from users who are not administrators\n- Sources do not give a specific command or file path to run this check","plain_action":"","needs_analyst":true,"not_affected_if":["netopeer2-not-installed","netconf-not-exposed"],"who_is_affected":"Systems running netopeer2-server where authenticated NETCONF users can send get RPCs, including low-privileged accounts. The advisory confirmed the crash on version 2.8.7 over NETCONF-over-SSH. Teams that do not run Netopeer2 or do not expose NETCONF to users can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001451,"input_tokens":4425,"output_tokens":2017,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-63201':13A,16A '2.8.21':194C '2.8.7':165C '2.8.8':183C,203C,216C 'addresssanit':172C 'advisori':181C 'affect':74C 'affected/fixed':196C 'alreadi':129C 'argument':155C 'attack':147C 'attacker-control':146C 'authent':37B,80C 'autom':21B 'base':68C 'boundari':197C 'buffer':131C 'build':217C 'caus':142C 'cb':109C 'code':175C 'comparison':187C 'configur':31B,66C 'confirm':162C,179C 'contain':101C 'control':148C 'craft':2A,46B 'crash':5A,54B,85C 'cve':11A,14A 'denial':56B,158C 'err':115C 'establish':210C 'execut':176C 'filter':48B,98C 'first':121C 'fix':190C 'format':9A,102C,122C,130C,139C 'get':3A,42B,92C,108C 'identifi':182C 'implement':64C 'interpret':145C 'invalid':96C,112C,153C 'locat':206C 'low':35B,78C 'low-privileg':34B,77C 'make':50B 'manag':32B,67C 'messag':124C 'netconf':6A,17B,26B,71C,81C,167C 'netopeer2':1A,18B,23B,52B,59C,87C 'netopeer2-server':51B,86C 'network':20B,30B,65C 'network-autom':19B 'np2log':117C,136C 'np2srv':106C 'over-ssh':168C 'pass':134C 'patch':185C 'percent':149C 'pointer':154C 'printf':118C 'privileg':36B,79C 'protocol':72C 'public':192C,202C 'read':152C 'releas':193C 'reliabl':173C 'remain':198C 'remot':84C,174C 'report':157C 'repositori':186C 'request':4A,43B 'rpc':93C,107C 'runtim':22B 'safe':125C 'send':40B,90C,110C 'sequenc':150C 'server':7A,27B,53B,62C,88C 'servic':58B,160C 'specifi':103C 'src/log.c':127C 'src/netconf.c':105C 'ssh':170C 'status':212C 'string':10A,140C 'subsequ':133C 'subtre':47B,97C 'tag':204C 'text':100C 'unresolv':199C 'untag':215C 'use':28B,166C 'user':38B,82C 'valu':113C 'verifi':188C 'version':75C,164C 'via':8A 'vsnprintf':120C 'vsyslog':143C 'whose':99C","nicknames":[],"mitigations":[],"who_affected":"Systems running netopeer2-server where authenticated NETCONF users can send get RPCs, including low-privileged accounts. The advisory confirmed the crash on version 2.8.7 over NETCONF-over-SSH. Teams that do not run Netopeer2 or do not expose NETCONF to users can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T22:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-63201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63201","severity":null,"published_at":"2026-10-30T22:16:58+00:00","modified_at":"2026-10-30T22:16:58+00:00","first_seen_at":"2026-10-30T22:25:57+00:00","fetched_at":"2026-10-30T22:25:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}