High [CVE-2026-71979] INDI indiserver: Denial of Service via malformed XML tag parsing
This high-severity Red Hat Linux advisory covers CVE-2026-71979.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes.
Attackers can send a single TCP packet on port 7624 with mismatched XML tags to trigger an unbounded sprintf() write into a fixed 1024-byte stack buffer in MsgQueue.cpp, terminating the daemon and disrupting all active client and driver sessions. indiserver's INDI protocol listener (TCP/7624 by default) provides no authentication or transport encryption, so any client that can reach the port is treated as trusted.
Its XML chunk parser (lilxml.cpp) formats parser-diagnostic messages -- including the attacker-controlled tag/attribute names that triggered them -- with sprintf() into a fixed 1024-byte stack buffer in indiserver/MsgQueue.cpp, with no bound on the size of those names.
A single specially crafted packet containing a mismatched, oversized closing XML tag overflows this buffer and crashes the indiserver process, terminating every connected client and driver session.
This is an unauthenticated, single-packet, remotely triggerable denial of service; no confidentiality or integrity impact, and no control-flow hijack, has been demonstrated.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- To mitigate this issue, restrict network access to the indiserver daemon's default port (TCP/7624) using firewall rules. If the indiserver is not required, disable the service. Note that disabling the service will prevent all INDI client and driver sessions from functioning.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.