Vulnerability record · CVE-2009-3591 · published 8 October 2009
CVE-2009-3591: Dopewars REQUESTJET invalid location denial of service
Ben Webb · Dopewars
Dopewars 1.5.12 fails to validate the location field in a REQUESTJET network message, causing a segmentation fault. A remote attacker can crash the game server with a single malformed message, disrupting availability for all connected players.
Description
Dopewars 1.5.12 allows remote attackers to cause a denial of service (segmentation fault) via a REQUESTJET message with an invalid location.
AV:N/AC:L/Au:N/C:N/I:N/A:P
Automated analysis
medium priorityThe flaw is remotely triggerable without authentication and public exploit code exists, but impact is limited to denial of service on a legacy game server.
What it is
Dopewars 1.5.12 fails to validate the location field in a REQUESTJET network message, causing a segmentation fault. A remote attacker can crash the game server with a single malformed message, disrupting availability for all connected players.
Impact
An attacker can crash the Dopewars server process, denying service to legitimate players. There is no evidence of code execution or data exposure; the effect is limited to availability.
Attack surface
Reachable over the network via the Dopewars game protocol by sending a crafted REQUESTJET message; no authentication or user interaction is required per the AV:N/AC:L/Au:N vector.
Exploitation
No CISA KEV listing, but EPSS is 0.528 (98.9th percentile) and a SecurityFocus BID is tagged Exploit, indicating public exploit code and elevated likelihood of attempts.
What to do
- Upgrade Dopewars to a version containing the serverside.c fix (revision 1033 or later).
- If patching is not possible, restrict network access to the Dopewars server to trusted clients only.
- Run the Dopewars server as an unprivileged account and under a supervisor that restarts it after crashes.
- Monitor for repeated server crashes and treat them as potential exploitation attempts.
Detection
- Watch for Dopewars server segmentation faults or unexpected process exits in system or application logs.
- Inspect network traffic for REQUESTJET messages containing malformed or out-of-range location values.
- Alert on repeated connection attempts from a single source followed by server termination.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2009-3591 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2009-3591), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.
