CVE-2021-36159: freebsd libfetch Out-of-bounds Read
Vulnerability summary
CVE-2021-36159 is a critical (CVSS 9.1) Out-of-bounds Read vulnerability in freebsd libfetch. EPSS estimates a 2.64% chance of exploitation in the next 30 days, higher than 85.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-08-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive mode implementation allows an out-of-bounds read because strtol is used to parse the relevant numbers into address bytes. It does not check if the line ends prematurely. If it does, the for-loop condition checks for the '\0' terminator one byte too late.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
EPSS trend
Probability
2.64%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
0.00 pp
From 2.64% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (gitlab.alpinelinux.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- apk-tools< 2.10.7-r0 | < 2.12.6-r0
Freebsd1 product
- libfetch< 2021-07-26
2 vendors · 2 products