CVE-2008-3746: neon 0.28.0 through 0.28.2 allows remote servers to cause a denial of service (NULL pointer dereference and...

Security readout for executives and security teams

This is an old availability issue in the neon HTTP/WebDAV client library. A malicious or compromised server could make affected client software crash during Digest authentication. The cited sources identify neon 0.28.0 through 0.28.2 as affected and neon 0.28.3 as the security release. Exposure is likely limited to systems running applications linked against neon 0.28.0, 0.28.1, or 0.28.2, especially clients connecting to untrusted or compromised HTTP/WebDAV servers using Digest authentication. Treat as a routine legacy remediation unless affected clients still contact untrusted servers. Business impact is service interruption from client crashes, not documented data compromise. Confirm whether the vulnerable library remains present before assigning urgent effort. Mitigation focus: Upgrade neon to 0.28.3 or a fixed vendor package.; Prioritize systems that connect to untrusted WebDAV or HTTP servers.; Check SUSE, Fedora, Ubuntu, Mandriva, or relevant vendor advisories for package fixes..

Prepared

Jun 28, 2026, 18:33 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.