CVE-2025-47268

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
iputils	iputils	< 20250602

References

https://bugzilla.suse.com/show_bug.cgi?id=1242300Issue Tracking
https://github.com/Zephkek/ping-rtt-overflow/Exploit, Third Party Advisory
https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40Patch
https://github.com/iputils/iputils/issues/584Exploit, Issue Tracking, Patch
https://github.com/iputils/iputils/pull/585Exploit, Issue Tracking, Patch
https://github.com/iputils/iputils/releases/tag/20250602Release Notes
https://github.com/Zephkek/ping-rtt-overflow/Exploit, Third Party Advisory

Timeline

Published: May 5, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-472698.3code-server runs VS Code on any machine anywhere through browser access. Prior to version 4.99.4, a maliciously crafted URL using the proxy CVE-2025-47273.7A vulnerability was found in Meteor up to 3.2.1 and classified as problematic. This issue affects the function Object.assign of the file pac CVE-2025-472707.5nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq CVE-2025-472716.3The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release CVE-2025-472725.5The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their account CVE-2025-472738.8setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerabilit CVE-2025-472742.4ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of cod CVE-2025-472759.1Auth0-PHP provides the PHP SDK for Auth0 Authentication and Management APIs. Starting in version 8.0.0-BETA1 and prior to version 8.14.0, se CVE-2025-472767.5Actualizer is a single shell script solution to allow developers and embedded engineers to create Debian operating systems (OS). Prior to ve CVE-2025-472779.8vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts envir CVE-2025-472781.8Flask is a web server gateway interface (WSGI) web application framework. In Flask 3.1.0, the way fallback key configuration was handled res CVE-2025-472793.1Undici is an HTTP/1.1 client for Node.js. Prior to versions 5.29.0, 6.21.2, and 7.5.0, applications that use undici to implement a webhook-l