Skip to content
Fencer Vulns
critical 9.8

CVE-2021-33913 json

libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated…

published 2022-01-19 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-20585

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.6%
EPSS 9.6% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.

Patch / fix

  • libspf2_project libspf2 1.2.11
  • libspf2 Debian 14, Debian 13, Debian 12 1.2.10-7.1

debian advisories DEBIAN-CVE-2021-33913

  • libspf2 Ubuntu 20.04 LTS 1.2.10-7+deb9u2build0.20.04.1
  • libspf2 Ubuntu Pro 16.04 LTS 1.2.10-6ubuntu0.1~esm2
  • libspf2 Ubuntu Pro 18.04 LTS 1.2.10-7ubuntu0.18.04.1~esm1

ubuntu advisories UBUNTU-CVE-2021-33913

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libspf2 Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.2.11-r0

alpine advisories ALPINE-CVE-2021-33913

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-33913 updated

libspf2: heap-based buffer overflow in SPF_record_expand_data in spf_expand.c

  • Red Hat All currently supported Red Hat products
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

9.64% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • nathanielbennett.com https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosure referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.