7.1

CVE-2021-28041: fedoraproject fedora Double Free

Modified
AliasesALPINE-CVE-2021-28041MGASA-2021-0261SUSE-SU-2021:4153-1
Published 05-03-2021Last modified 14-10-2026

Vulnerability summary

CVE-2021-28041 is a high (CVSS 7.1) Double Free vulnerability in fedoraproject fedora. EPSS estimates a 3.51% chance of exploitation in the next 30 days, higher than 89.2% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
7.1/10
010
High · v3.1 (NVD)
EPSS score
3.51%
0%100%
Low · +0.09 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:13842-1

Timeline

  1. 05-03-2021
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

3.51%

Chance of exploitation in the next 30 days

Percentile

89%

Versus all other CVEs

30-day change

Increase +0.09 pp

From 3.42% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.

Netapp5 products
Suse4 products
  • openssh-askpass-gnome&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP3< 8.4p1-3.9.1
  • openssh&distro=SUSE Linux Enterprise Micro 5.1< 8.4p1-3.9.1
  • openssh&distro=SUSE Linux Enterprise Module for Basesystem 15 SP3< 8.4p1-3.9.1
  • openssh&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3< 8.4p1-3.9.1
Opensuse2 products
  • openssh-askpass-gnome&distro=openSUSE Leap 15.3< 8.4p1-3.9.1
  • openssh&distro=openSUSE Leap 15.3< 8.4p1-3.9.1
Oracle2 products
Alpine1 product
  • openssh≥ 8.2, < 8.3_p1-r2 | ≥ 8.2, < 8.4_p1-r1 | ≥ 8.2, < 8.5_p1-r0
Debian1 product
  • openssh< 1:8.4p1-5
Fedoraproject1 product
Mageia1 product
  • openssh< 8.4p1-2.1.mga8
Openbsd1 product
Ubuntu1 product
  • openssh< 1:8.2p1-4ubuntu0.2

10 vendors · 19 products

References

23 links
Show all 23 references