How severe is CVE-2023-29323?

CVE-2023-29323 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-29323 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-29323?

CVE-2023-29323 primarily affects Opensmtpd. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-29323?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2023-29323 published?

CVE-2023-29323 was published on 2023-04-04 and last updated on 2026-06-17.

CVE-2023-29323

CVE-2023-29323 is a high-severity vulnerability in Opensmtpd with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.8)
EPSS exploit prediction: 0% (20th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Opensmtpd
Published: 2023-04-04
Last modified: 2026-06-17

Description

ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address.

Frequently asked questions

What is CVE-2023-29323?: ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit f748277, can abort upon a connection from a local, scoped IPv6 address.
How severe is CVE-2023-29323?: CVE-2023-29323 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-29323 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (20th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-29323?: CVE-2023-29323 primarily affects Opensmtpd. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-29323?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2023-29323 published?: CVE-2023-29323 was published on 2023-04-04 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:opensmtpd:opensmtpd:*:*:*:*:*:*:*:*
cpe:2.3:o:openbsd:openbsd:7.1:*:*:*:*:*:*:*
cpe:2.3:o:openbsd:openbsd:7.2:*:*:*:*:*:*:*

More vulnerabilities in Opensmtpd

CVE-2020-8794 — Critical (CVSS 9.8): OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for…
CVE-2020-35680 — High (CVSS 7.5): smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of…
CVE-2020-35679 — High (CVSS 7.5): smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger a "very…
CVE-2025-62875 — Medium (CVSS 5.5): An Improper Check for Unusual or Exceptional Conditions vulnerability in OpenSMTPD allows local users to…
CVE-2020-8793 — Medium (CVSS 4.7): OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions) because of a…

All CVEs affecting Opensmtpd →