{"action":"Upgrade connman to 1.44-3 or later.","affected":[{"fixed":"1.44-3","introduced":"0"}],"component":"connman","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:13","exploited":false,"fixed_versions":["1.44-3"],"id":"tcs_01M5NNAPJB51FYRERA4AGRXT8R","modified_at":"2026-09-01T20:05:45.886681243Z","published_at":"2025-04-05T23:15:40.910Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2025-32366","https://security-tracker.debian.org/tracker/CVE-2025-32366"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2025-32366#Debian:13/connman","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2025-32366"}],"summary":"In ConnMan through 1.44, parse_rr in dnsproxy.c has a memcpy length that depends on an RR RDLENGTH value, i.e., *rdlen=ntohs(rr->rdlen) and memcpy(response+offset,*end,*rdlen) without a check for whet"}