CVE-2010-3609: The extension parser in slp_v2message.c in OpenSLP 1.2.1, and other versions before SVN revision 1647, as u...

Security readout for executives and security teams

CVE-2010-3609 is a denial-of-service flaw in OpenSLP’s extension parsing. A crafted Service Location Protocol packet can make SLPD loop indefinitely. The cited record specifically calls out VMware ESX/ESXi 4.0 and 4.1 using affected OpenSLP versions. Exposure is most likely where legacy VMware ESX/ESXi 4.0 or 4.1, or OpenSLP 1.2.1 and earlier pre-revision-1647 builds, remain reachable. Internet or broad internal reachability of SLPD increases business risk. Treat this as a legacy availability risk. It is not described as data theft or code execution, but exposed virtualization infrastructure can create operational disruption. Prioritize if old ESX/ESXi or OpenSLP remains in production. Mitigation focus: Check VMware and operating-system vendor advisories for the specific supported update path.; Upgrade OpenSLP packages to vendor-fixed builds containing the post-revision-1647 parser fix.; Restrict SLPD access to trusted management networks only..

Prepared

Jun 24, 2026, 13:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.