CVE-2023-30575: Apache Guacamole: Incorrect calculation of Guacamole protocol element lengths

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-07 · updated 2026-06-17
Weakness: CWE-131

Description

Apache Guacamole 1.5.1 and older may incorrectly calculate the lengths of instruction elements sent during the Guacamole protocol handshake, potentially allowing an attacker to inject Guacamole instructions during the handshake through specially-crafted data.

Affected products

Apache Software Foundation Apache Guacamole: before 1.5.2 — fixed in 1.5.2

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Guacamole 1.5.2. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread/tn63n2lon0h5p45oft834t1dqvvxownv
https://lists.apache.org/thread/tn63n2lon0h5p45oft834t1dqvvxownv

Get alerted when CVE-2023-30575 or the next vulnerability affects your stack