CVE-2021-28361

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Mar 13, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-283627.5An issue was discovered in Contiki through 3.0. When sending an ICMPv6 error message because of invalid extension header options in an incom CVE-2021-283636.5The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The ini CVE-2021-283728.3ThroughTek's Kalay Platform 2.0 network allows an attacker to impersonate an arbitrary ThroughTek (TUTK) device given a valid 20-byte unique CVE-2021-283737.5The auth_internal plugin in Tiny Tiny RSS (aka tt-rss) before 2021-03-12 allows an attacker to log in via the OTP code without a valid passw CVE-2021-283747.5The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak CVE-2021-283757.8An issue was discovered in the Linux kernel through 5.11.6. fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applicat CVE-2021-283762.7ChronoForms 7.0.7 allows fname Directory Traversal to read arbitrary files.CVE-2021-283775.3ChronoForums 2.0.11 allows av Directory Traversal to read arbitrary files.CVE-2021-283785.4Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.CVE-2021-283798.8web/upload/UploadHandler.php in Vesta Control Panel (aka VestaCP) through 0.9.8-27 and myVesta through 0.9.8-26-39 allows uploads from a dif CVE-2021-283805.4The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend u CVE-2021-283819.8The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.