NetApp Ontap
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in NetApp Ontap.
By the Year
In 2025 there have been 1 vulnerability in NetApp Ontap with an average score of 6.8 out of ten. Last year, in 2024 Ontap had 3 security vulnerabilities published. Right now, Ontap is on track to have less security vulnerabilities in 2025 than it did last year. Last year, the average CVE base score was greater by 0.70
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2025 | 1 | 6.80 |
| 2024 | 3 | 7.50 |
| 2023 | 2 | 5.25 |
| 2022 | 0 | 0.00 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Ontap vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent NetApp Ontap Security Vulnerabilities
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled
CVE-2025-26465
6.8 - Medium
- February 18, 2025
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.
Detection of Error Condition Without Action
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response
CVE-2024-27316
7.5 - High
- April 04, 2024
HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.
Allocation of Resources Without Limits or Throttling
libexpat through 2.6.1
CVE-2024-28757
7.5 - High
- March 10, 2024
libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_ExternalEntityParserCreate).
XEE
The DNS message parsing code in `named` includes a section whose computational complexity is overly high
CVE-2023-4408
7.5 - High
- February 13, 2024
The DNS message parsing code in `named` includes a section whose computational complexity is overly high. It does not cause problems for typical DNS traffic, but crafted queries and responses may cause excessive CPU load on the affected `named` instance by exploiting this flaw. This issue affects both authoritative servers and recursive resolvers. This issue affects BIND 9 versions 9.0.0 through 9.16.45, 9.18.0 through 9.18.21, 9.19.0 through 9.19.19, 9.9.3-S1 through 9.11.37-S1, 9.16.8-S1 through 9.16.45-S1, and 9.18.11-S1 through 9.18.21-S1.
ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a
vulnerability
CVE-2023-27317
4.6 - Medium
- December 15, 2023
ONTAP 9 versions 9.12.1P8, 9.13.1P4, and 9.13.1P5 are susceptible to a vulnerability which will cause all SAS-attached FIPS 140-2 drives to become unlocked after a system reboot or power cycle or a single SAS-attached FIPS 140-2 drive to become unlocked after reinsertion. This could lead to disclosure of sensitive information to an attacker with physical access to the unlocked drives.
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature
CVE-2023-27536
5.9 - Medium
- March 30, 2023
An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connections with incorrect user permissions due to a failure to check for changes in the CURLOPT_GSSAPI_DELEGATION option. This vulnerability affects krb5/kerberos/negotiate/GSSAPI transfers and could potentially result in unauthorized access to sensitive information. The safest option is to not reuse connections if the CURLOPT_GSSAPI_DELEGATION option has been changed.
authentification
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Splunk Universal Forwarder or by NetApp? Click the Watch button to subscribe.
