CVE-2026-33250

Freeciv21 is a free open source, turn-based, empire-building strategy game. Versions prior to 3.1.1 crash with a stack overflow when receiving specially-crafted packets. A remote attacker can use this to take down any public server. A malicious server can use this to crash the game on the player's machine. Authentication is not needed and, by default, logs do not contain any useful information. All users should upgrade to Freeciv21 version 3.1.1. Running the server behind a firewall can help mitigate the issue for non-public servers. For local games, Freeciv21 restricts connections to the current user and is therefore not affected.

• CWE-20
• CWE-121

• https://github.com/longturn/freeciv21/commit/ad8e18ca22595529599782b2984bf44df8d69ed6
• https://github.com/longturn/freeciv21/releases/tag/v3.1.1
• https://github.com/longturn/freeciv21/security/advisories/GHSA-f76g-6w3f-f6r3
• https://redmine.freeciv.org/issues/1955

Published

Mar 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33245React Router is a router for React. In versions 7.7.0 throug…4.7
• CVE-2026-33246NATS-Server is a High-Performance server for NATS.io, a clou…5.4
• CVE-2026-33247NATS-Server is a High-Performance server for NATS.io, a clou…5.3
• CVE-2026-33248NATS-Server is a High-Performance server for NATS.io, a clou…4.2
• CVE-2026-33249NATS-Server is a High-Performance server for NATS.io, a clou…4.3
• CVE-2026-3325SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the…10
• CVE-2026-33251Discourse is an open-source discussion platform. Prior to ve…5.4
• CVE-2026-33252The Go MCP SDK used Go's standard encoding/json. Prior to ve…6.5
• CVE-2026-33253SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers …8.4
• CVE-2026-33254An attacker can create a large number of concurrent DoQ or D…7.5
• CVE-2026-33256An attacker can send a web request that causes unlimited mem…7.5
• CVE-2026-33257An attacker can send a web request that causes unlimited mem…7.5