$ cve CVE-2021-35942 JSON

CVE-2021-35942

9.1

CRITICAL · CVSS 3.1 · EPSS 2.6% (pctl 85)

In your normal cycle

Critical by CVSS (9.1), but no sign of active exploitation.

Description

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Scoring

CVSS	9.1 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS	2.61% — more likely to be exploited than 85% of all CVEs
Weakness	CWE-190
On CISA KEV	no
Public exploit	none known
Published	2021-07-22
Last modified	2026-10-14

Affected (7)

Vendor	Product
debian	debian linux
gnu	glibc
netapp	active iq unified manager
netapp	e-series santricity os controller
netapp	hci management node
netapp	ontap select deploy administration utility
netapp	solidfire

References

→ the Explorer · watch your stack · NVD