Moderate Vulnerability in FreeIPMI Packages: Denial of Service via Buffer Overflow
Summary
ALSA-2026:36210: Moderate: freeipmi security update. Affects freeipmi versions < 1.6.18-1.el9_8. Fixed in 1.6.18-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FreeIPMI is a suite of tools and libraries that implement the Intelligent Platform Management Interface (IPMI) specification, enabling remote console and system management capabilities. It is widely used in server management to monitor and control hardware components. The affected packages include freeipmi, freeipmi-bmc-watchdog, freeipmi-devel, freeipmi-ipmidetectd, and freeipmi-ipmiseld, all of which are integral to the functionality of IPMI systems.
Vulnerability Detail
The vulnerability identified as CVE-2026-50031 is a denial of service issue caused by a buffer overflow in the ipmi-oem client of FreeIPMI. This flaw allows an attacker to exploit the buffer overflow, potentially crashing the service or causing it to become unresponsive. The vulnerability arises from improper handling of input data, which can lead to memory corruption and service disruption.
How To Fix
Minimum fixed version
1.6.18-1.el9_8
This is the first release that contains the fix.
sudo dnf update freeipmiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit access to the ipmi-oem client or disable it until the package is updated. This can be done by modifying the firewall rules to restrict access to the service or by stopping the service entirely using the command:
sudo systemctl stop freeipmi
Conclusion
The FreeIPMI packages contain a moderate vulnerability that could lead to denial of service due to a buffer overflow. It is crucial to update to the patched version to mitigate this risk. Users should also consider temporary workarounds while planning for updates.
See every vulnerability recorded for freeipmi →
FAQ
CVE-2026-50031 is a vulnerability in FreeIPMI that allows for denial of service through a buffer overflow in the ipmi-oem client.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your manifest file for vulnerabilities.
Exploitation of this vulnerability can lead to service crashes or unresponsiveness, impacting system management and monitoring capabilities.
Yes, a patch is available in version 1.6.18-1.el9_8 and later for all affected FreeIPMI packages.
If immediate updates are not possible, consider implementing access restrictions or disabling the vulnerable service as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for freeipmi.
