Detections
Analytics

Fedora 43 : libmaxminddb (2026-814a1deec8)

high Nessus Plugin ID 300172

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-814a1deec8 advisory.

 # libmaxminddb 1.13.1
 - Re-release for Ubuntu PPA, no code changes.

 # libmaxminddb 1.13.0
 - `MMDB_get_entry_data_list()` now validates that the claimed array/map size is plausible given the remaining bytes in the data section. A crafted database could previously claim millions of array elements while only having a few bytes of data, causing disproportionate memory allocation (memory amplification DoS).
 - Fixed integer overflow in `MMDB_read_node()` and `find_ipv4_start_node()` pointer arithmetic. The `node_number * record_length` multiplication was performed in `uint32_t`, which could overflow for very large databases. Now cast to `uint64_t` before multiplying, matching the pattern already used in `find_address_in_search_tree()`.
 - Fixed printf format specifier mismatches in `mmdblookup`'s metadata dump. `%i` was used for unsigned types and `%llu` for `uint64_t`, which is technically undefined behavior. Now uses the portable `PRIu32`, `PRIu16`, and `PRIu64` macros from `<inttypes.h>`.
 - Fixed an integer overflow in the search tree bounds check in `find_address_in_search_tree()`. The addition of `node_count` and `data_section_size` was performed in `uint32_t` arithmetic, which could wrap on very large databases, causing valid lookups to be incorrectly rejected as corrupt.
 - Fixed a NULL pointer dereference in `mmdblookup` when displaying metadata for a database with an out-of-range `build_epoch`. The `gmtime()` return value is now checked before passing to `strftime()`.
 - `MMDB_close()` now NULLs the `file_content`, `data_section`, and `metadata_section` pointers and zeroes `file_size`, `data_section_size`, and `metadata_section_size` after unmapping. Previously, calling `MMDB_close()` twice on the same struct (or calling it after a failed `MMDB_open()` that succeeded at mapping) would double-munmap the file content, which is undefined behavior.
 - Fixed a stack buffer overflow in `print_indentation()` when `MMDB_dump_entry_data_list()` was called with a negative `indent` value. The negative integer was cast to `size_t`, producing a massive value passed to `memset()`. Negative indent values are now clamped to 0.
 - `MMDB_lookup_string()` now sets `*mmdb_error` to `MMDB_SUCCESS` when `getaddrinfo` fails (non-zero `*gai_error`). Previously, `*mmdb_error` was left uninitialized in this case, which could cause callers to read an indeterminate value.
 - Added a recursion depth limit to `skip_map_or_array()`, matching the existing `MAXIMUM_DATA_STRUCTURE_DEPTH` (512) limit already used by `get_entry_data_list()`. A crafted MMDB file with deeply nested maps or arrays could previously cause a stack overflow via unbounded recursion in the `MMDB_aget_value` / `MMDB_get_value` code path.
 - Fixed an off-by-one error in `MMDB_read_node()` that allowed reading one node past the end of the search tree when called with `node_number == node_count`.
 This caused the function to read from the data section separator and return an invalid record with an underflowed data offset. The check now correctly rejects `node_number >= node_count`.
 - The handling of float and double types was rewritten to fix compiler errors and to eliminate the use of volatile.
 - Improved endian preprocessor check if `MMDB_LITTLE_ENDIAN` is not set.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected libmaxminddb package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2026-814a1deec8

Plugin Details

Severity: High

ID: 300172

File Name: fedora_2026-814a1deec8.nasl

Version: 1.1

Type: local

Agent: unix

Published: 3/2/2026

Updated: 3/2/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Vulnerability Information

CPE: p-cpe:/a:fedoraproject:fedora:libmaxminddb, cpe:/o:fedoraproject:fedora:43

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 2/25/2026

Vulnerability Publication Date: 2/25/2026

Reference Information