CVE-2021-3468

MEDIUM
Published Jun 2, 20215y ago · Modified Jun 17, 20262w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Jun 2, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

A flaw was found in avahi in versions 0.6 up to 0.8. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the client_work function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of the avahi service, which becomes unresponsive after this flaw is triggered.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-835

Affected Products 2

VendorProductVersionRange
avahiavahi*≥0.6  –  ≤0.8
debiandebian_linux9.0any

References 3

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1939614
    Issue Tracking
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2022/06/msg00009.html
    Mailing ListThird Party Advisory
  • lists.debian.org https://lists.debian.org/debian-lts-announce/2023/06/msg00028.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.