Call Cc maintains a focused portfolio of lightweight Scheme-based tools and libraries, including the Chicken compiler, HTTP client, and Spiffy web server, which serve specialized roles in functional programming and embedded scripting environments. The vendor's vulnerability profile reflects the scope and structure of these components rather than broad attack surface or systemic weakness patterns. Defenders tracking this vendor should focus on supply-chain and embedding contexts where these tools integrate into larger systems; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Call Cc over time
Signals from CVEs in this vendor scope (21 CVEs).
21 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-6310CRITICAL Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function. | Nov 22, 2019 | 9.8 | 32 | NO | NO |
CVE-2013-2024HIGH OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0. | Oct 31, 2019 | 8.8 | 32 | NO | NO |
CVE-2012-6125CRITICAL Chicken before 4.8.0 is susceptible to algorithmic complexity attacks related to hash table collisions. | Oct 31, 2019 | 9.8 | 31 | NO | NO |
CVE-2016-6830CRITICAL The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in its execve() call. This | Jan 10, 2017 | 9.8 | 31 | NO | NO |
CVE-2017-6949HIGH An issue was discovered in CHICKEN Scheme through 4.12.0. When using a nonstandard CHICKEN-specific extension to allocate an SRFI-4 vector in unmanaged memory, the vector size woul | Mar 16, 2017 | 8.1 | 27 | NO | NO |
CVE-2012-6122HIGH Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allows attackers to cause a denial of service (crash) by opening a file descriptor with a large integer value. | Oct 31, 2019 | 7.5 | 25 | NO | NO |
CVE-2017-9334HIGH An incorrect "pair?" check in the Scheme "length" procedure results in an unsafe pointer dereference in all CHICKEN Scheme versions prior to 4.13, which allows an attacker to cause | Jun 1, 2017 | 7.5 | 25 | NO | NO |
CVE-2022-45145CRITICAL egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file. | Dec 10, 2022 | 9.8 | 24 | NO | NO |
CVE-2016-6286HIGH The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which would allow attackers to direct CGI programs which use this e | Jan 10, 2017 | 7.5 | 24 | NO | NO |
CVE-2017-11343HIGH Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack. An attacker can provide cr | Jul 17, 2017 | 7.5 | 23 | NO | NO |
Signals from CVEs in this vendor scope (21 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Call Cc.
Media articles that mention a CVE ID that affects a product developed by Call Cc — matched by CVE ID, not by vendor name.