Vulnerability Report

CVE-2016-9686

Title: Puppet Puppet Enterprise Improper Input Validation

Input Validation Error

Proof Of Concept

No public PoC currently indexed for CVE-2016-9686.

CWE Category CWE-20

Published Date Feb 08, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 5.3 CVSS v3.0

Exploit Probability (EPSS)

0.38%

Vulnerability Summary

CVE-2016-9686: The Puppet Communications Protocol (PCP) Broker incorrectly validates message header sizes. An attacker could use this to crash the PCP Broker, preventing commands from being sent to agents. This is resolved in Puppet Enterprise 2016.4.3 and 2016.5.2.

Impacted Vendors

puppet 1

puppetlabs 1

Reference Links

https://puppet.com/security/cve/cve-2016-9686 https://puppet.com/security/cve/cve-2016-9686

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

5.3

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

5.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns