CVE-2002-0391
CVSS 9.8 CRITICAL: integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based… EPSS 58% (99th percentile).
Vulnerabilities & Exploits
HPE has published fixes for 45 NonStop Server vulnerabilities, including a critical flaw in XDR Streams T0248 that affects T0248L01^AAD and earlier. INCIBE-CERT says the issue is CVE-2002-0391, and the remedial build is T0248L01^AAF.
The bug is a buffer overflow in HTTP request parsing when chunked transfer encoding is handled. A remote, unauthenticated attacker can send a specially crafted request and trigger denial of service or arbitrary code execution; for this one, HPE says the fix is only available on RVU L24.08 and later and requires a coldload, so it cannot be swapped in online.
That puts the exposure window on the maintenance plan as much as on the patch itself: if XDR Streams sits on a system that cannot take downtime quickly, the vulnerable path can stay live longer than a normal urgent fix cycle would suggest. The broader advisory matters too, but this critical item is the one where remediation timing becomes part of the risk.
1 source · 10h ago
CVSS 9.8 CRITICAL: integer overflow in xdr_array function in RPC servers for operating systems that use libc, glibc, or other code based… EPSS 58% (99th percentile).
INCIBE-CERT
Múltiples vulnerabilidades en NonStop Servers de HPE
HPE ha publicado 45 vulnerabilidades: una de severidad crítica, 25 de severidad alta, 16 de severidad
originalPart of the PlainSec briefing for 2026-10-13
Every edition of this story: HPE NonStop fix for XDR Streams needs a coldload