CVEs / CVE-2024-48990
CVE-2024-48990: needrestart needrestart vulnerability
- high 7.8 CVSS 3.1 (from the CNA)
- EPSS 29.2% chance of exploitation in the next 30 days, higher than 98% of CVEs (9 Nov 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2024-48990
Description
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| needrestart needrestart | before 3.8 | 3.8 |
| needrestart_project needrestart | before 3.8 | 3.8 |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 9 Nov 2026.
Severity
| CVSS 3.1 | 7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by the CNA ([email protected]) |
|---|---|
| Weakness | CWE-427 |
References
- CVE-2024-48990 on NVD
- CVE-2024-48990 on OSV
- https://github.com/liske/needrestart/commit/fcc9a4401392231bef4ef5ed026a0d7a275149ab Patch
- https://www.cve.org/CVERecord?id=CVE-2024-48990 VDB Entry
- https://www.qualys.com/2024/11/19/needrestart/needrestart.txt Third Party Advisory
- http://seclists.org/fulldisclosure/2024/Nov/17
- https://lists.debian.org/debian-lts-announce/2024/11/msg00014.html
- https://www.openwall.com/lists/oss-security/2024/11/19/1 Mailing List
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.