CVE-2021-3595

An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.

• CWE-824

• https://bugzilla.redhat.com/show_bug.cgi?id=1970489Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/09/msg00000.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/
• https://security.gentoo.org/glsa/202107-44Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210805-0004/Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1970489Issue Tracking, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/09/msg00000.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GCKWZWY64EHTOQMLVLTSZ4AA27EWRJMH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGPQZFVJCFGDSISFXPCQTTBBD7QZLJKI/
• https://security.gentoo.org/glsa/202107-44Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210805-0004/Third Party Advisory

Published

Jun 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-35944Couchbase Server 6.5.x, 6.6.x through 6.6.2, and 7.0.0 has a…7.5
• CVE-2021-35945Couchbase Server 6.5.x, 6.6.0 through 6.6.2, and 7.0.0, has …7.5
• CVE-2021-35946A receiver of a federated share with access to the database …9.8
• CVE-2021-35947The public share controller in the ownCloud server before ve…5.3
• CVE-2021-35948Session fixation on password protected public links in the o…5.4
• CVE-2021-35949The shareinfo controller in the ownCloud Server before 10.8.…5.3
• CVE-2021-35951fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker all…7.5
• CVE-2021-35952fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker all…5.3
• CVE-2021-35953fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker all…7.5
• CVE-2021-35954fastrack Reflex 2.0 W307S_REFLEX_v90.89 Activity Tracker all…8.1
• CVE-2021-35955Contao >=4.0.0 allows backend XSS via HTML attributes to an …4.8
• CVE-2021-35956Stored cross-site scripting (XSS) in the embedded webserver …5.4