CVE-2021-20291

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).

• CWE-667

• https://bugzilla.redhat.com/show_bug.cgi?id=1939485Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WX24EITRXVHDM5M223BVTJA2ODF2FSHI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM/
• https://unit42.paloaltonetworks.com/cve-2021-20291/Exploit, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1939485Issue Tracking, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WX24EITRXVHDM5M223BVTJA2ODF2FSHI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM/
• https://unit42.paloaltonetworks.com/cve-2021-20291/Exploit, Third Party Advisory

Published

Apr 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-20286A flaw was found in libnbd 1.7.3. An assertion failure in nb…2.7
• CVE-2021-20287Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20288An authentication flaw was found in ceph in versions before …7.2
• CVE-2021-20289A flaw was found in RESTEasy in all versions of RESTEasy up …5.3
• CVE-2021-2029Vulnerability in the Oracle Scripting product of Oracle E-Bu…9.8
• CVE-2021-20290An improper authorization handling flaw was found in Foreman…6.1
• CVE-2021-20292There is a flaw reported in the Linux kernel in versions bef…6.7
• CVE-2021-20293A reflected Cross-Site Scripting (XSS) flaw was found in RES…6.1
• CVE-2021-20294A flaw was found in binutils readelf 2.35 program. An attack…7.8
• CVE-2021-20295It was discovered that the update for the virt:rhel module i…6.5
• CVE-2021-20296A flaw was found in OpenEXR in versions before 3.0.0-beta. A…5.3
• CVE-2021-20297A flaw was found in NetworkManager in versions before 1.30.0…5.5