CVE-2021-3672

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

• CWE-79
• CWE-79

• https://bugzilla.redhat.com/show_bug.cgi?id=1988342Issue Tracking, Third Party Advisory
• https://c-ares.haxx.se/adv_20210810.htmlExploit, Patch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://security.gentoo.org/glsa/202401-02
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1988342Issue Tracking, Third Party Advisory
• https://c-ares.haxx.se/adv_20210810.htmlExploit, Patch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdfPatch, Third Party Advisory
• https://security.gentoo.org/glsa/202401-02
• https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory

Published

Nov 23, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36712Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allow…5.4
• CVE-2021-36713Cross Site Scripting (XSS) vulnerability in the DataTables p…6.1
• CVE-2021-36716A ReDoS (regular expression denial of service) flaw was foun…7.5
• CVE-2021-36717Synerion TimeNet version 9.21 contains a directory traversal…7.5
• CVE-2021-36718SYNEL - eharmonynew / Synel Reports - The attacker can log i…6.5
• CVE-2021-36719PineApp - Mail Secure - The attacker must be logged in as a …8.8
• CVE-2021-36720PineApp - Mail Secure - Attacker sending a request to :/bloc…6.1
• CVE-2021-36721Sysaid API User Enumeration - Attacker sending requests to s…5.3
• CVE-2021-36722Emuse - eServices / eNvoice SQL injection can be used in var…9.8
• CVE-2021-36723Emuse - eServices / eNvoice Exposure Of Private Personal Inf…7.5
• CVE-2021-36724ForeScout - SecureConnector Local Service DoS - A low privil…5.5
• CVE-2021-3673A vulnerability was found in Radare2 in version 5.3.1. Impro…7.5