Netopeer2 is a server for implementing network configuration management based on the "NETCONF" Protocol. In affected versions, a low-privileged authenticated "NETCONF" user can remotely crash "netopeer2-server" by sending a "get RPC" with an invalid "subtree filter" whose text contains format specifiers. In "src/netconf.c", "np2srv_rpc_get_cb()" sends the invalid value through "ERR()" to "np2log_printf()", where "vsnprintf()" first formats the message safely. In "src/log.c", that already formatted buffer is subsequently passed to "np2log()" as the format string itself, causing "vsyslog()" to interpret attacker-controlled percent sequences and read invalid pointer arguments. The reported denial of service was confirmed on version 2.8.7 using "NETCONF"-over-SSH and AddressSanitizer; reliable remote code execution was not confirmed. "The advisory identifies 2.8.8 as patched"; repository comparisons verify the fix in public release 2.8.21. The affected/fixed boundary remains unresolved because no public 2.8.8 tag was located, which does not establish the status of an untagged 2.8.8 build.