CVE-2021-21708

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In PHP versions 7.4.x below 7.4.28, 8.0.x below 8.0.16, and 8.1.x below 8.1.3, when using filter functions with FILTER_VALIDATE_FLOAT filter and min/max limits, if the filter fails, there is a possibility to trigger use of allocated memory after free, which can result it crashes, and potentially in overwrite of other memory chunks and RCE. This issue affects: code that uses FILTER_VALIDATE_FLOAT with min/max limits.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Feb 27, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-21714.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.33 CVE-2021-21726.5Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.23 and prio CVE-2021-217224.4A ZTE Smart STB is impacted by an information leak vulnerability. The device did not fully verify the log, so attackers could use this vulne CVE-2021-217237.5Some ZTE products have a DoS vulnerability. Due to the improper handling of memory release in some specific scenarios, a remote attacker can CVE-2021-217244.4A ZTE product has a memory leak vulnerability. Due to the product's improper handling of memory release in certain scenarios, a local attack CVE-2021-217255.7A ZTE product has an information leak vulnerability. An attacker with higher authority can go beyond their authority to access files in othe CVE-2021-217262.3Some ZTE products have an input verification vulnerability in the diagnostic function interface. Due to insufficient verification of some pa CVE-2021-217277.5A ZTE product has a DoS vulnerability. A remote attacker can amplify traffic by sending carefully constructed IPv6 packets to the affected d CVE-2021-217285.3A ZTE product has a configuration error vulnerability. Because a certain port is open by default, an attacker can consume system processing CVE-2021-217296.5Some ZTE products have CSRF vulnerability. Because some pages lack CSRF random value verification, attackers could perform illegal authoriza CVE-2021-21734.1Vulnerability in the Recovery component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 12.2.0.1, 18c and 19c.CVE-2021-217309.8A ZTE product is impacted by improper access control vulnerability. The attacker could exploit this vulnerability to access CLI by brute for