CVE-2020-12430

An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_driver.c in libvirt 4.10.0 though 6.x before 6.1.0. A memory leak was found in the virDomainListGetStats libvirt API that is responsible for retrieving domain statistics when managing QEMU guests. This flaw allows unprivileged users with a read-only connection to cause a memory leak in the domstats command, resulting in a potential denial of service.

• CWE-401

• https://bugzilla.redhat.com/show_bug.cgi?id=1804548Issue Tracking, Permissions Required, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1828190Issue Tracking, Patch, Vendor Advisory
• https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/
• https://security.netapp.com/advisory/ntap-20200518-0003/
• https://usn.ubuntu.com/4371-1/
• https://bugzilla.redhat.com/show_bug.cgi?id=1804548Issue Tracking, Permissions Required, Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1828190Issue Tracking, Patch, Vendor Advisory
• https://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581
• https://lists.debian.org/debian-lts-announce/2024/04/msg00000.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D5GE6ISYUL3CIWO3FQRUGMKTKP2NYED2/
• https://security.netapp.com/advisory/ntap-20200518-0003/
• https://usn.ubuntu.com/4371-1/

Published

Apr 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12424When constructing a permission prompt for WebRTC, a URI was …6.5
• CVE-2020-12425Due to confusion processing a hyphen character in Date.parse…6.5
• CVE-2020-12426Mozilla developers and community members reported memory saf…8.8
• CVE-2020-12427The Western Digital WD Discovery application before 3.8.229 …8.8
• CVE-2020-12429Online Course Registration 2.0 has multiple SQL injections t…9.8
• CVE-2020-1243<p>A denial of service vulnerability exists when Microsoft H…7.8
• CVE-2020-12431A Windows privilege change issue was discovered in Splashtop…6.6
• CVE-2020-12432The WOPI API integration for Vereign Collabora CODE through …6.1
• CVE-2020-12438An XSS vulnerability exists in the banners.php page of PHP-F…5.4
• CVE-2020-12439Grin before 3.1.0 allows attackers to adversely affect avail…5.3
• CVE-2020-1244A denial of service vulnerability exists when Connected User…7.1
• CVE-2020-12440Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…