CVE-2009-3617

CVE-2009-3617 is a high-severity vulnerability in Tatsuhiro Tsujikawa Aria2 with a CVSS 2.0 base score of 7.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-134.

Key facts

• Severity: High (CVSS 2.0 base score 7.6)
• EPSS exploit prediction: 5% (91st percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-134
• Affected product: Tatsuhiro Tsujikawa Aria2
• Published: 2009-10-20
• Last modified: 2026-06-16

Description

Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI. NOTE: some of these details are obtained from third party information.

Frequently asked questions

What is CVE-2009-3617?

Format string vulnerability in the AbstractCommand::onAbort function in src/AbstractCommand.cc in aria2 before 1.6.2, when logging is enabled, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via format string specifiers in a download URI. NOTE: some of these details are obtained from third party information.

How severe is CVE-2009-3617?

CVE-2009-3617 has a CVSS 2.0 base score of 7.6, rated high severity.

Is CVE-2009-3617 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 5% (91st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2009-3617?

CVE-2009-3617 primarily affects Tatsuhiro Tsujikawa Aria2. In total, 37 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2009-3617?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2009-3617 published?

CVE-2009-3617 was published on 2009-10-20 and last updated on 2026-06-16.

References

• http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/NEWS?revision=1586
• http://aria2.svn.sourceforge.net/viewvc/aria2/trunk/src/AbstractCommand.cc?r1=1539&r2=1572
• http://marc.info/?l=oss-security&m=125568632528906&w=2
• http://marc.info/?l=oss-security&m=125572053420493&w=2
• http://osvdb.org/59087
• http://secunia.com/advisories/31732
• http://www.vupen.com/english/advisories/2009/2960
• https://bugzilla.redhat.com/show_bug.cgi?id=529342
• https://fedorahosted.org/rel-eng/ticket/2495

Affected products (37)

• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:*:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.3:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.4:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.11.5:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.12.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.12.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.0\+1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.1\+1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.2:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.13.2\+1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.14.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.14.0\+1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.1\+1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.1\+2:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.2:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.15.3:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.16.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.16.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:0.16.2:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.0.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.1.2:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.2:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.3.3:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.4.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.4.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.5.0:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.5.1:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.5.2:*:*:*:*:*:*:*
• cpe:2.3:a:tatsuhiro_tsujikawa:aria2:1.6.0:*:*:*:*:*:*:*

More vulnerabilities in Tatsuhiro Tsujikawa Aria2

• CVE-2009-3575 — Critical (CVSS 10.0): Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, 1.2.0, and other versions allows remote attackers to…
• CVE-2010-1512 — Medium (CVSS 4.3): Directory traversal vulnerability in aria2 before 1.9.3 allows remote attackers to create arbitrary files via directory…

All CVEs affecting Tatsuhiro Tsujikawa Aria2 →

Other CWE-134 vulnerabilities

• CVE-2012-1851 — Critical (CVSS 10.0): Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,…
• CVE-2012-0242 — Critical (CVSS 10.0): Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary…
• CVE-2011-2475 — Critical (CVSS 10.0): Format string vulnerability in ECTrace.dll in the iMailGateway service in the Internet Mail Gateway in OneBridge Server…
• CVE-2011-1568 — Critical (CVSS 10.0): Format string vulnerability in the logText function in shmemmgr9.dll in IGSSdataServer.exe 9.00.00.11074, and…
• CVE-2010-4235 — Critical (CVSS 10.0): Format string vulnerability in RealNetworks Helix Server 12.x, 13.x, and 14.x before 14.2, and Helix Mobile Server…
• CVE-2011-0270 — Critical (CVSS 10.0): Format string vulnerability in nnmRptConfig.exe in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows…

Browse all CWE-134 vulnerabilities →