Vulnerabiity Spotlight: Tarantool Denial of Service Vulnerabilities
Summary: Cisco Talos disclosed two denial of service vulnerabilities, CVE-2016-9036 and CVE-2016-9037, in Tarantool, an open-source Lua-based application server used by service providers including Mail.RU and Badoo. A crafted packet can make the Msgpuck library's 'mp_check' function incorrectly report success when decoding a map16 packet that reads outside a buffer, and a separate crafted packet can cause the 'xrow_header_decode' function to access an out-of-bounds memory location, each resulting in denial of service on the server.
What's compelling: Tarantool is named as infrastructure at Mail.RU and Badoo, and the flaw sits in Msgpuck, which is also distributed as a standalone library for other C and C++ applications - so the exposure is not limited to Tarantool deployments. Talos lists Snort rules 41080-41082 for detection and notes those rules may change as more vulnerability information emerges.
Read the original at Cisco Talos ↗
- Topics
- Endpoint & Network Security
- Mentions
- CVE-2016-9036CVE-2016-9037
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026