Homepage

Reachable Assertion Affecting direwolf package, versions <1.8.1+dfsg-2

Severity

 Recommended
low

Based on Debian security rating.

Threat Intelligence

EPSS
0.46% (40th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIANUNSTABLE-DIREWOLF-14559948
  • published24 Dec 2025
  • disclosed22 Dec 2025
Report a new vulnerability Found a mistake?

Introduced: 22 Dec 2025

CVE-2025-34458  (opens in a new tab)
CWE-617  (opens in a new tab)

How to fix?

Upgrade Debian:unstable direwolf to version 1.8.1+dfsg-2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream direwolf package and not the direwolf package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

wb2osz/direwolf (Dire Wolf) versions up to and including 1.8, prior to commit 3658a87, contain a reachable assertion vulnerability in the APRS MIC-E decoder function aprs_mic_e() located in src/decode_aprs.c. When processing a specially crafted AX.25 frame containing a MIC-E message with an empty or truncated comment field, the application triggers an unhandled assertion checking for a non-empty comment. This assertion failure causes immediate process termination, allowing a remote, unauthenticated attacker to cause a denial of service by sending malformed APRS traffic.