CVE-2021-33574

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

• CWE-416

• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
• https://security.gentoo.org/glsa/202107-07Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210629-0005/Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896Exploit, Issue Tracking, Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1Issue Tracking
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
• https://security.gentoo.org/glsa/202107-07Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210629-0005/Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896Exploit, Issue Tracking, Third Party Advisory
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1Issue Tracking

Published

May 25, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33562A reflected cross-site scripting (XSS) vulnerability in Shop…4.8
• CVE-2021-33563Koel before 5.1.4 lacks login throttling, lacks a password s…7.5
• CVE-2021-33564An argument injection vulnerability in the Dragonfly gem bef…9.8
• CVE-2021-33570Postbird 0.8.4 allows stored XSS via the onerror attribute o…5.4
• CVE-2021-33571In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 befo…7.5
• CVE-2021-33572A Denial-of-Service (DoS) vulnerability was discovered in F-…6.5
• CVE-2021-33575The Pixar ruby-jss gem before 1.6.0 allows remote attackers …9.8
• CVE-2021-33576An issue was discovered in Cleo LexiCom 5.5.0.0. Within the …9.8
• CVE-2021-33577An issue was discovered in Cleo LexiCom 5.5.0.0. The require…5.3
• CVE-2021-33578Echo ShareCare 8.15.5 is susceptible to SQL injection vulner…9.8
• CVE-2021-33580User controlled `request.getHeader("Referer")`, `request.get…7.5
• CVE-2021-33581MashZone NextGen through 10.7 GA has an SSRF vulnerability t…7.2