Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8754-1 advisory.

    It was discovered that Freeciv incorrectly handled certain network packets, resulting in a stack overflow.
    A remote attacker could possibly use this issue to cause Freeciv clients or servers to crash, resulting in     a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:20423-1 advisory.

    Changes in freeciv:

    - freeciv 3.2.4:
      * CVE-2026-33250: Fix a vulnerability allowing remote crashing         of the server (boo#1260036)
      * SDL2 client: Fix crash on selecting nation style or nation
    - includes changes from version 3.2.3:
      * Restore server to sane state after savegame loading failures
      * Assert unit goto tile validity rather than outright crashing
      * Improvements to AI players
      * Client UI tweaks and bug fixes
      * translation updates

    - freeciv 3.2.2, a compatible general bugfix release:
      * Fix backward compatibility in loading unit actions from a savegame
      * Fix crashes after continuing game from a savegame
      * Fix an error after player is added mid-game
      * Fix various crashes in client, and client UI tweaks

    - freeciv 3.2.1, a compatible general bugfix release:
      * Fixes for units carrying goods
      * Fix no city being considered capital for a turn after savegame         loading
      * Corrected what situations make it impossible to airlift a unit
      * Fix culture victory with very high values of culture
      * Client UI and crash fixes

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash     with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take     down any public server. A malicious server can use this to crash the game on the player's machine.
    Authentication is not needed and, by default, logs do not contain any useful information. All users should     upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for     non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore     not affected. (CVE-2026-33250)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6173 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6173-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     March 21, 2026                        https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : freeciv     CVE ID         : CVE-2026-33250

    Louis Moureaux discovered that incorrect packet processing in the     game server of Freeciv, a free clone of the turn based strategy game     Civilization, could result in denial of service.

    For the oldstable distribution (bookworm), this problem has been fixed     in version 3.0.6-1+deb12u1.

    For the stable distribution (trixie), this problem has been fixed in     version 3.1.4+ds-2+deb13u1.

    We recommend that you upgrade your freeciv packages.

    For the detailed security status of freeciv please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/freeciv

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
345852	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Freeciv vulnerability (USN-8754-1)	Nessus	Ubuntu Local Security Checks	Local	high
304224	openSUSE 16 Security Update : freeciv (openSUSE-SU-2026:20423-1)	Nessus	SuSE Local Security Checks	Local	high
303285	Linux Distros Unpatched Vulnerability : CVE-2026-33250	Nessus	Misc.	Local	high
303284	Debian dsa-6173 : freeciv - security update	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2026-33250

high

Tenable Plugins

high

high

high

high