CVE-2021-20305

A flaw was found in Nettle in versions before 3.7.2, where several Nettle signature verification functions (GOST DSA, EDDSA & ECDSA) result in the Elliptic Curve Cryptography point (ECC) multiply function being called with out-of-range scalers, possibly resulting in incorrect results. This flaw allows an attacker to force an invalid signature, causing an assertion failure or possible validation. The highest threat to this vulnerability is to confidentiality, integrity, as well as system availability.

• CWE-327
• CWE-787

• https://bugzilla.redhat.com/show_bug.cgi?id=1942533Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/
• https://security.gentoo.org/glsa/202105-31Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211022-0002/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4933Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1942533Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/09/msg00008.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MQKWVVMAIDAJ7YAA3VVO32BHLDOH2E63/
• https://security.gentoo.org/glsa/202105-31Third Party Advisory
• https://security.netapp.com/advisory/ntap-20211022-0002/Third Party Advisory
• https://www.debian.org/security/2021/dsa-4933Third Party Advisory

Published

Apr 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2030Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-20300A flaw was found in OpenEXR's hufUncompress functionality in…5.5
• CVE-2021-20301Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-20302A flaw was found in OpenEXR's TiledInputFile functionality. …5.5
• CVE-2021-20303A flaw found in function dataWindowForTile() of IlmImf/ImfTi…6.1
• CVE-2021-20304A flaw was found in OpenEXR's hufDecode functionality. This …7.5
• CVE-2021-20306A flaw was found in the BPMN editor in version jBPM 7.51.0.F…4.3
• CVE-2021-20307Format string vulnerability in panoFileOutputNamesCreate() i…9.8
• CVE-2021-20308Integer overflow in the htmldoc 1.9.11 and before may allow …9.8
• CVE-2021-20309A flaw was found in ImageMagick in versions before 7.0.11 an…7.5
• CVE-2021-2031Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-20310A flaw was found in ImageMagick in versions before 7.0.11, w…7.5