CVE-2009-3476

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-29 · updated 2026-06-16
Weakness: CWE-119

Description

Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 Shibboleth Service Provider software 1.3.x before 1.3.4, and XMLTooling before 1.2.2 as used in Internet2 Shibboleth Service Provider software 2.x before 2.2.1, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a malformed encoded URL.

Affected products

Internet2 Opensaml: 1.1, 1.1.1
Internet2 Shibboleth-Sp: 1.3.1, 1.3.2, 1.3.3, 1.3f, 2.0, 2.1 (+1)
Internet2 Xmltooling: 1.0.1, 1.1.0, 1.1.1, 1.2.0, 1.2.1

References

http://secunia.com/advisories/36869
http://secunia.com/advisories/36870
http://shibboleth.internet2.edu/secadv/secadv_20090826.txt
http://www.securityfocus.com/bid/36514
https://exchange.xforce.ibmcloud.com/vulnerabilities/53471
http://secunia.com/advisories/36869
http://secunia.com/advisories/36870
http://shibboleth.internet2.edu/secadv/secadv_20090826.txt
http://www.securityfocus.com/bid/36514
https://exchange.xforce.ibmcloud.com/vulnerabilities/53471

Get alerted when CVE-2009-3476 or the next vulnerability affects your stack