CVE-2021-36773

uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality).

• CWE-674

• https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adocExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/06/msg00024.htmlMailing List, Third Party Advisory
• https://news.ycombinator.com/item?id=27833752Issue Tracking, Third Party Advisory
• https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adocExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/06/msg00024.htmlMailing List, Third Party Advisory
• https://news.ycombinator.com/item?id=27833752Issue Tracking, Third Party Advisory

Published

Jul 18, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36767In Digi RealPort through 4.10.490, authentication relies on …9.8
• CVE-2021-36769A reordering issue exists in Telegram before 7.8.1 for Andro…5.3
• CVE-2021-3677A flaw was found in postgresql. A purpose-crafted query can …6.5
• CVE-2021-36770Encode.pm, as distributed in Perl through 5.34.0, allows loc…7.8
• CVE-2021-36771Zoho ManageEngine ADManager Plus before 7110 allows reflecte…6.1
• CVE-2021-36772Zoho ManageEngine ADManager Plus before 7110 allows stored X…6.1
• CVE-2021-36774Apache Kylin allows users to read data from other database s…6.5
• CVE-2021-36775a Improper Access Control vulnerability in SUSE Rancher allo…8.8
• CVE-2021-36776A Improper Access Control vulnerability in SUSE Rancher allo…8.8
• CVE-2021-36777A Reliance on Untrusted Inputs in a Security Decision vulner…8.8
• CVE-2021-36778A Incorrect Authorization vulnerability in SUSE Rancher allo…7.5
• CVE-2021-36779A Missing Authentication for Critical Function vulnerability…9.6