Improper input validation in Kaillera Project Server
CVE-2011-10020
Kaillera Server version 0.86 is vulnerable to a denial-of-service condition triggered by sending a malformed UDP packet after the initial handshake. Once a client sends a valid HELLO0.83 packet and receives a response, any subsequent malformed packet causes the server to crash and become unresponsive. This flaw stems from improper input validation in the server’s UDP packet handler, allowing unauthenticated remote attackers to disrupt service availability.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
EPSS exploit prediction
EPSS: 0.009 (58.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 58.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Kaillera Project Server — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/… (exploit)
- www.exploit-db.com/exploits/17460 (exploit)
- kaillera.com/ (product)
- www.vulncheck.com/advisories/kaillera-server-dos-via-malformed-udp-packet (third-party-advisory)
Frequently asked questions
- What is CVE-2011-10020?
- CVE-2011-10020 is a vulnerability in Kaillera Project Server, classified under Improper Input Validation. Published 2025-08-20.
- Is CVE-2011-10020 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.