CVE catalog

CVE-2006-3251

hashcash: CVE-2006-3251

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
3.65% · Oct 25, 2026

Heap-based buffer overflow in the array_push function in hashcash.c for Hashcash before 1.21 might allow attackers to execute arbitrary code via crafted entries.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianhashcashsid1.22-2fixed
Debianhashcashforky1.22-2fixed
Debianhashcashtrixie1.22-2fixed
Debianhashcashbookworm1.22-1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianhashcashsourcesid1.21not yet assignedNot reported[376444]
Debianhashcashsourceforky1.21not yet assignedNot reported[376444]
Debianhashcashsourcetrixie1.21not yet assignedNot reported[376444]
Debianhashcashsourcebookworm1.21not yet assignedNot reported[376444]

[Debian bug #376444]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [hashcash]Fixed
    Details (2)

    • 1.22-1 · amd64 · bookworm

      Fixed · Fixed: 1.21

      dsa · hashcash · debian · bookworm; dsa · hashcash · debian · 12

    • 1.22-1 · arm64 · bookworm

      Fixed · Fixed: 1.21

      dsa · hashcash · debian · bookworm; dsa · hashcash · debian · 12

[Debian 13 (Trixie)]

  • [hashcash]Fixed
    Details (2)

    • 1.22-2 · amd64 · trixie

      Fixed · Fixed: 1.21

      dsa · hashcash · debian · 13

    • 1.22-2 · arm64 · trixie

      Fixed · Fixed: 1.21

      dsa · hashcash · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]