CVE-2021-21359

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.

• CWE-405
• CWE-674

• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397pThird Party Advisory
• https://packagist.org/packages/typo3/cms-coreRelease Notes, Third Party Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2021-005Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397pThird Party Advisory
• https://packagist.org/packages/typo3/cms-coreRelease Notes, Third Party Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2021-005Vendor Advisory

Published

Mar 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21352Anuko Time Tracker is an open source, web-based time trackin…9.1
• CVE-2021-21353Pug is an npm package which is a high-performance template e…9
• CVE-2021-21354Pollbot is open source software which "frees its human maste…6.1
• CVE-2021-21355TYPO3 is an open source PHP based web content management sys…8.6
• CVE-2021-21357TYPO3 is an open source PHP based web content management sys…8.3
• CVE-2021-21358TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2021-2136Vulnerability in the Oracle WebLogic Server product of Oracl…9.8
• CVE-2021-21360Products.GenericSetup is a mini-framework for expressing the…5.3
• CVE-2021-21361The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin conta…6.5
• CVE-2021-21362MinIO is an open-source high performance object storage serv…6.5
• CVE-2021-21363swagger-codegen is an open-source project which contains a t…7
• CVE-2021-21364swagger-codegen is an open-source project which contains a t…5.5