CVE-2021-43523

In uClibc and uClibc-ng before 1.0.39, incorrect handling of special characters in domain names returned by DNS servers via gethostbyname, getaddrinfo, gethostbyaddr, and getnameinfo can lead to output of wrong hostnames (leading to domain hijacking) or injection into applications (leading to remote code execution, XSS, applications crashes, etc.). In other words, a validation step, which is expected in any stub resolver, does not occur.

• CWE-79
• CWE-79

• https://github.com/wbx-github/uclibc-ng/commit/0f822af0445e5348ce7b7bd8ce1204244f31d174Patch, Third Party Advisory
• https://uclibc-ng.org/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2021/11/09/1Exploit, Mailing List, Third Party Advisory
• https://github.com/wbx-github/uclibc-ng/commit/0f822af0445e5348ce7b7bd8ce1204244f31d174Patch, Third Party Advisory
• https://uclibc-ng.org/Vendor Advisory
• https://www.openwall.com/lists/oss-security/2021/11/09/1Exploit, Mailing List, Third Party Advisory

Published

Nov 10, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-43517FOSCAM Camera FI9805E with firmware V4.02.R12.00018510.10012…9.8
• CVE-2021-43518Teeworlds up to and including 0.7.5 is vulnerable to Buffer …7.8
• CVE-2021-43519Stack overflow in lua_resume of ldo.c in Lua Interpreter 5.1…5.5
• CVE-2021-4352The JobSearch WP Job Board plugin for WordPress is vulnerabl…5.3
• CVE-2021-43521A Buffer Overflow vulnerability exists in zlog 1.2.15 via zl…7.5
• CVE-2021-43522An issue was discovered in Insyde InsydeH2O with kernel 5.1 …7.5
• CVE-2021-43527NSS (Network Security Services) versions prior to 3.73 or 3.…9.8
• CVE-2021-43528Thunderbird unexpectedly enabled JavaScript in the compositi…6.5
• CVE-2021-43529Thunderbird versions prior to 91.3.0 are vulnerable to the h…9.8
• CVE-2021-4353The WooCommerce Dynamic Pricing and Discounts plugin for Wor…5.3
• CVE-2021-43530A Universal XSS vulnerability was present in Firefox for And…6.1
• CVE-2021-43531When a user loaded a Web Extensions context menu, the Web Ex…4.3