CVE-2021-3677

A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server settings include max_worker_processes=0, the known versions of this attack are infeasible. However, undiscovered variants of the attack may be independent of that setting.

• CWE-200

• https://bugzilla.redhat.com/show_bug.cgi?id=2001857Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202211-04Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220407-0008/Third Party Advisory
• https://www.postgresql.org/support/security/CVE-2021-3677/Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2001857Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202211-04Third Party Advisory
• https://security.netapp.com/advisory/ntap-20220407-0008/Third Party Advisory
• https://www.postgresql.org/support/security/CVE-2021-3677/Vendor Advisory

Published

Mar 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36763In CODESYS V3 web server before 3.5.17.10, files or director…7.5
• CVE-2021-36764In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Poin…7.5
• CVE-2021-36765In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP r…7.5
• CVE-2021-36766Concrete5 through 8.5.5 deserializes Untrusted Data. The vul…7.2
• CVE-2021-36767In Digi RealPort through 4.10.490, authentication relies on …9.8
• CVE-2021-36769A reordering issue exists in Telegram before 7.8.1 for Andro…5.3
• CVE-2021-36770Encode.pm, as distributed in Perl through 5.34.0, allows loc…7.8
• CVE-2021-36771Zoho ManageEngine ADManager Plus before 7110 allows reflecte…6.1
• CVE-2021-36772Zoho ManageEngine ADManager Plus before 7110 allows stored X…6.1
• CVE-2021-36773uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support…7.5
• CVE-2021-36774Apache Kylin allows users to read data from other database s…6.5
• CVE-2021-36775a Improper Access Control vulnerability in SUSE Rancher allo…8.8