{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"connman","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":[],"id":"tcs_01M5NNAPET0JV9MF01BXZ49P1S","modified_at":"2026-09-01T20:05:45.886681243Z","published_at":"2025-04-05T23:15:40.910Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-32366","https://security-tracker.debian.org/tracker/CVE-2025-32366"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-32366","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-32366"}],"summary":"In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whet"}