CVE-2021-33913

libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.

• CWE-787

• https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220bThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00015.htmlMailing List, Third Party Advisory
• https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosureExploit, Third Party Advisory
• https://security.gentoo.org/glsa/202401-22
• https://github.com/shevek/libspf2/tree/8131fe140704eaae695e76b5cd09e39bd1dd220bThird Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/01/msg00015.htmlMailing List, Third Party Advisory
• https://nathanielbennett.com/blog/libspf2-cve-jan-2022-disclosureExploit, Third Party Advisory
• https://security.gentoo.org/glsa/202401-22

Published

Jan 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-33907The Zoom Client for Meetings for Windows in all versions bef…9.8
• CVE-2021-33909fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before…7.8
• CVE-2021-3391MobileIron Mobile@Work through 2021-03-22 allows attackers t…5.3
• CVE-2021-33910basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, …5.5
• CVE-2021-33911Zoho ManageEngine ADManager Plus before 7110 allows remote c…9.8
• CVE-2021-33912libspf2 before 1.2.11 has a four-byte heap-based buffer over…9.8
• CVE-2021-3392A use-after-free flaw was found in the MegaRAID emulator of …3.2
• CVE-2021-33923Insecure permissions in Confluent Ansible (cp-ansible) 5.5.0…5.5
• CVE-2021-33924Confluent Ansible (cp-ansible) version 5.5.0, 5.5.1, 5.5.2 a…9.8
• CVE-2021-33925SQL Injection vulnerability in nitinparashar30 cms-corephp t…9.8
• CVE-2021-33926An issue in Plone CMS v. 5.2.4, 5.2.3, 5.2.2, 5.2.1, 5.2.0, …8.8
• CVE-2021-33928Buffer overflow vulnerability in function pool_installable i…7.5