Vulnerability record · CVE-2004-0396 · published 14 June 2004
CVE-2004-0396: CVS pserver heap buffer overflow allows remote code execution
CCvs · Cvs
CVS versions 1.11.x through 1.11.15 and 1.12.x through 1.12.7 contain a heap-based buffer overflow that is triggered when the pserver mechanism processes crafted Entry lines. Because pserver is a network-facing service, a remote attacker can corrupt heap memory and potentially execute arbitrary code on the CVS server.
Description
Heap-based buffer overflow in CVS 1.11.x up to 1.11.15, and 1.12.x up to 1.12.7, when using the pserver mechanism allows remote attackers to execute arbitrary code via Entry lines.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityThe vulnerability is remotely reachable without authentication, can lead to code execution, and has a very high EPSS score, though it is not in CISA KEV and affects legacy software.
What it is
CVS versions 1.11.x through 1.11.15 and 1.12.x through 1.12.7 contain a heap-based buffer overflow that is triggered when the pserver mechanism processes crafted Entry lines. Because pserver is a network-facing service, a remote attacker can corrupt heap memory and potentially execute arbitrary code on the CVS server.
Impact
A remote attacker can execute arbitrary code with the privileges of the CVS server process, leading to full compromise of the repository host. Even without reliable code execution, the overflow can crash the service and disrupt version control operations.
Attack surface
The flaw is reached over the network through the CVS pserver protocol, as indicated by the AV:N vector and the description's reference to the pserver mechanism. No authentication or user interaction is required per the CVSS vector (Au:N), meaning an unauthenticated remote client can trigger the vulnerable parsing path.
Exploitation
CVE-2004-0396 is not listed in CISA KEV, but EPSS shows a 30-day exploitation probability of 0.67525 (99.275th percentile), indicating a high likelihood of attempted exploitation. Reference tags include Patch and Vendor Advisory, but no public exploit tag is present in the supplied data.
What to do
- Upgrade CVS to a version later than 1.11.15 or 1.12.7 as directed by the vendor advisories.
- If pserver is not required, disable or block the pserver service and restrict network access to the CVS port.
- Apply the patches referenced by the Debian, Red Hat, and CERT/CC advisories for affected distributions.
- Run the CVS service with least privilege and isolate it from sensitive data where possible.
- Monitor vendor advisories for updated fixed versions if the installed CVS release is older than the listed ranges.
Detection
- Inspect CVS server logs for malformed or unusually long Entry lines in pserver sessions.
- Monitor for crashes or abnormal termination of the CVS daemon that could indicate heap corruption attempts.
- Use network detection to flag pserver traffic containing oversized or non-standard Entry records.
- Correlate CVS process crashes with inbound connections from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-0396 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-0396), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
