Back
CVE-2010-3438
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands…
Critical9.8EPSS 1.7%
- Published
- Updated
- Reserved
- Assigned by
- redhat
Description
libpoe-component-irc-perl before v6.32 does not remove carriage returns and line feeds. This can be used to execute arbitrary IRC commands by passing an argument such as "some text\rQUIT" to the 'privmsg' handler, which would cause the client to disconnect from the server.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.7% · top 23% of all CVEs (6 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Weakness
- stripping of CR/LF allows arbitrary IRC command execution
- CWE-134 (opens in a new tab)All about CWE-134 and its CVEs
Affected products
libpoe-component-irc-perl · libpoe-component-irc-perl
- affected before v6.32
References (3)
- https://security-tracker.debian.org/tracker/CVE-2010-3438 (opens in a new tab)x_refsource_MISCx_transferred
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-3438 (opens in a new tab)x_refsource_MISCx_transferred
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=581194 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2010-3438)Record last updated .