CVE-2021-36980

Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a use-after-free in decode_NXAST_RAW_ENCAP (called from ofpact_decode and ofpacts_decode) during the decoding of a RAW_ENCAP action.

• CWE-416
• CWE-416

• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851Patch, Third Party Advisory
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/openvswitch/OSV-2020-2197.yamlThird Party Advisory
• https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f039722115300f58fPatch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/65c61b0c23a0d474696d7b1cea522a5016a8aeb3Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/6d67310f4d2524b466b98f05ebccc1add1e8cf35Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/77cccc74deede443e8b9102299efc869a52b65b2Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/8ce8dc34b5f73b30ce0c1869af9947013c3c6575Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/9926637a80d0d243dbf9c49761046895e9d1a8e2Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202311-16
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851Patch, Third Party Advisory
• https://github.com/google/oss-fuzz-vulns/blob/main/vulns/openvswitch/OSV-2020-2197.yamlThird Party Advisory
• https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f039722115300f58fPatch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/65c61b0c23a0d474696d7b1cea522a5016a8aeb3Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/6d67310f4d2524b466b98f05ebccc1add1e8cf35Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/77cccc74deede443e8b9102299efc869a52b65b2Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/8ce8dc34b5f73b30ce0c1869af9947013c3c6575Patch, Third Party Advisory
• https://github.com/openvswitch/ovs/commit/9926637a80d0d243dbf9c49761046895e9d1a8e2Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202311-16

Published

Jul 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36975Win32k Elevation of Privilege Vulnerability7.8
• CVE-2021-36976libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_…6.5
• CVE-2021-36977matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a hea…6.5
• CVE-2021-36978QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-ba…5.5
• CVE-2021-36979Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_…5.5
• CVE-2021-3698A flaw was found in Cockpit in versions prior to 260 in the …7.5
• CVE-2021-36981In the server in SerNet verinice before 1.22.2, insecure Jav…8.8
• CVE-2021-36982AIMANAGER before B115 on MONITORAPP Application Insight Web …8.1
• CVE-2021-36983replay-sorcery-kms in Replay Sorcery 0.6.0 allows a local at…7.8
• CVE-2021-36985There is a Code injection vulnerability in Huawei Smartphone…7.5
• CVE-2021-36986There is a vulnerability of tampering with the kernel in Hua…9.8
• CVE-2021-36987There is a issue that nodes in the linked list being freed f…5.9