CVE-2021-21359: Denial of Service in Page Error Handling
Vulnerability summary
CVE-2021-21359 is a high (CVSS 7.5) vulnerability in typo3. EPSS estimates a 1.73% chance of exploitation in the next 30 days, higher than 77.6% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 23-03-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
1.73%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.73% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-405Asymmetric Resource Consumption (Amplification)The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
- CWE-674Uncontrolled RecursionThe product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
1 vendor · 2 products
References
3 links- github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-4p9g-qgx9-397pX Refsource CONFIRMThird Party Advisory