CISA ADP Vulnrichment

Why this deserves its current priority

A CVSS score is not reported in the current record. Known-exploitation status makes exposure review time-sensitive. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps n/a/n/a (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for n/a/n/a.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Aug 7, 2017

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Oct 21, 2025

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   May 24, 2026

4. Added to CISA KEV

   Mar 19, 2025

   Evidence: source:kev:kev:kev:record

Sources and claim methodology

• Source referenceweb.archive.org
• CISA Known Exploited Vulnerabilities catalogcisa.gov

Related CVEs

• Open edX Platform: Path traversal via prefix-bypass in safe_extractall Path ValidationAlso CWE-22
• Suricata ippair: hash collision can cause incorrect state reuse across IPv4 and IPv6Same generic ecosystem
• Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalationSame generic ecosystem
• Suricata dhcp: unbounded transactions in unidirectional traffic can lead to resource exhaustionSame generic ecosystem
• Suricata datasets: NULL pointer dereference in JSON/NDJSON dataset loadingSame generic ecosystem
• Suricata swf: heap buffer overflow in SWF decompression depth handlingSame generic ecosystem