ip_input.c in BSD-derived TCP/IP implementations

CVE-1999-0001 is a denial-of-service flaw in ip_input.c, the IP packet ingestion path of BSD-derived TCP/IP stacks. Sending crafted IP packets to an affected host can crash or hang the kernel. Affected versions are FreeBSD 3.0, OpenBSD 2.3 and 2.4, and BSDI BSD/OS 3.1 — all released in the late 1990s and long since end-of-lifed. The bug was patched in OpenBSD errata for 2.3 and subsequent FreeBSD/BSDI releases.

The vendor CVSS v2 score of 5.0 MEDIUM was reasonable *in 1999* — unauthenticated remote DoS with low complexity is a real concern on a production box. But in 2026, the severity is effectively zero. There is no supported operating system on earth still running these versions. Even niche embedded BSD appliances have long since moved past these codebases. The vendor score is a historical artifact, not an operational risk.

Why this verdict

• Dead target population: FreeBSD 3.0, OpenBSD 2.3/2.4, and BSDI 3.1 are not present in any modern enterprise. Hardware that could run these kernels is itself largely decommissioned.
• DoS-only impact ceiling: Even if a target existed, the blast radius is a single-host availability loss with no persistence, no code execution, and no lateral movement. A reboot restores service.
• Role multiplier: There is no high-value-role analysis to perform because the affected component (late-1990s BSD kernels) does not occupy *any* role in modern infrastructure — not as a hypervisor, DC, CI/CD server, edge appliance, or anything else. The installed base in 2026 is effectively 0%.
• Patched for 26+ years: Every maintained BSD derivative has carried the fix since at least 2000. Even unmaintained forks inherited the patch long ago.

Why not higher?

There is no scenario in which this vulnerability warrants any severity rating above IGNORE. The affected software does not exist in production anywhere. Assigning even LOW would imply backlog hygiene work is needed, but there is nothing to patch — no host runs these versions.

Why not lower?

IGNORE is already the lowest possible rating. No further downgrade is possible.

1. Confirm no affected BSD versions in your CMDB — Run a single asset-inventory query filtering for FreeBSD < 3.1, OpenBSD < 2.5, or BSDI < 4.0. If zero results (expected), document the result and close the ticket. This takes minutes, not days.

Run on any Linux/macOS/BSD auditor workstation with SSH access to your fleet, or against your CMDB export. No special privileges needed. Example: bash check_cve_1999_0001.sh (reads from stdin or a host list file).

#!/usr/bin/env bash
# check_cve_1999_0001.sh — CVE-1999-0001 applicability check
# Checks whether any host in the environment runs an affected BSD version.
# Usage: echo 'hostlist.txt' | bash check_cve_1999_0001.sh
#   or:  bash check_cve_1999_0001.sh < hostlist.txt
# Output: VULNERABLE / PATCHED / UNKNOWN per host, summary at end.
# Requires: ssh access to target hosts (key-based recommended).

VULN_COUNT=0
SAFE_COUNT=0
UNKNOWN_COUNT=0

while IFS= read -r host; do
  [ -z "$host" ] && continue
  os_info=$(ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no "$host" 'uname -srm' 2>/dev/null)
  if [ $? -ne 0 ]; then
    echo "$host: UNKNOWN (unreachable)"
    ((UNKNOWN_COUNT++))
    continue
  fi
  # Check for affected versions
  if echo "$os_info" | grep -qiE '(FreeBSD 3\.0|OpenBSD 2\.[34]|BSD/OS 3\.1)'; then
    echo "$host: VULNERABLE ($os_info)"
    ((VULN_COUNT++))
  else
    echo "$host: PATCHED ($os_info)"
    ((SAFE_COUNT++))
  fi
done

echo ""
echo "=== Summary ==="
echo "VULNERABLE: $VULN_COUNT"
echo "PATCHED:    $SAFE_COUNT"
echo "UNKNOWN:    $UNKNOWN_COUNT"

if [ "$VULN_COUNT" -gt 0 ]; then
  echo "RESULT: VULNERABLE"
  exit 1
elif [ "$UNKNOWN_COUNT" -gt 0 ] && [ "$SAFE_COUNT" -eq 0 ]; then
  echo "RESULT: UNKNOWN"
  exit 2
else
  echo "RESULT: PATCHED"
  exit 0
fi

Sources

1. NVD — CVE-1999-0001 Detail
2. Snyk — CVE-1999-0001 in FreeBSD
3. OpenBSD 2.3 Errata (source route fix)
4. Tenable — CVE-1999-0001
5. CVEFeed — CVE-1999-0001
6. Feedly CVE Intelligence — CVE-1999-0001
7. trickest/cve GitHub index