Collin Funk

New Capabilities

As of September 2026: Opened the upstream fix and coordinated disclosure

In March 2026, researchers found a buffer overflow in GNU telnetd that had hidden in the codebase for roughly 32 years. The flaw, tracked as CVE-2026-32746, lets a remote attacker corrupt server memory before the login prompt ever appears. Because most Linux distributions and countless embedded devices base their telnet daemons on GNU inetutils, the vulnerable code ships almost everywhere.

Updated Sep 17