---
id: "CVE-2026-63201"
kind: "vulnerability"
aliases: ["CVE-2026-63201"]
title: "Netopeer2: crafted get request crashes NETCONF server via format strings"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["netconf", "netopeer2", "network-automation", "runtime"]
not_affected_if: ["netconf-not-exposed", "netopeer2-not-installed"]
published_at: "2026-10-30T22:16:58+00:00"
first_seen_at: "2026-10-30T22:25:57+00:00"
updated_at: "2026-10-30T22:27:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63201", "first_seen_at": "2026-10-30T22:25:57+00:00"}]
---

# Netopeer2: crafted get request crashes NETCONF server via format strings

Netopeer2 is a NETCONF server used for network configuration management. A low-privileged authenticated user can send a get request with a crafted subtree filter that makes netopeer2-server crash, a denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the installed Netopeer2 version and compare it with the fixed versions listed below
- Confirm whether netopeer2-server accepts NETCONF-over-SSH sessions from users who are not administrators
- Sources do not give a specific command or file path to run this check

## Fix

- Netopeer2 `2.8.21` (fix verified by repository comparison)
- The advisory names `2.8.8` as patched, but no public `2.8.8` tag was located, so an untagged 2.8.8 build is unverified

## Timeline

- 2026-10-30T22:25:57+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-63201

## From the sources

Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privileged authenticated `NETCONF` user can remotely crash `netopeer2-server` by sending a `get RPC` with an invalid `subtree filter` whose text contains format specifiers. In `src/netconf.c`, `np2srv_rpc_get_cb()` sends the invalid value through `ERR()` to `np2log_printf()`, where `vsnprintf()` first formats the message safely. In `src/log.c`, that already formatted buffer is subsequently passed to `np2log()` as the format string itself, causing `vsyslog()` to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using `NETCONF`-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. `The advisory identifies 2.8.8 as patched`; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_