$ cve CVE-2021-33574 JSON

CVE-2021-33574

9.8

CRITICAL · CVSS 3.1 · EPSS 2.9% (pctl 86)

In your normal cycle

Critical by CVSS (9.8), but no sign of active exploitation.

Description

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Scoring

CVSS	9.8 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS	2.87% — more likely to be exploited than 86% of all CVEs
Weakness	CWE-416
On CISA KEV	no
Public exploit	none known
Published	2021-05-25
Last modified	2026-06-17

Affected (20)

Vendor	Product
debian	debian linux
fedoraproject	fedora
gnu	glibc
netapp	cloud backup
netapp	e-series santricity os controller
netapp	h300e
netapp	h300e firmware
netapp	h300s
netapp	h300s firmware
netapp	h410s
netapp	h410s firmware
netapp	h500e
netapp	h500e firmware
netapp	h500s
netapp	h500s firmware
netapp	h700e
netapp	h700e firmware
netapp	h700s
netapp	h700s firmware
netapp	solidfire baseboard management controller firmware

References

→ the Explorer · watch your stack · NVD