CVE-2021-41229

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

BlueZ is a Bluetooth protocol stack for Linux. In affected versions a vulnerability exists in sdp_cstate_alloc_buf which allocates memory which will always be hung in the singly linked list of cstates and will not be freed. This will cause a memory leak over time. The data can be a very large object, which can be caused by an attacker continuously sending sdp packets and this may cause the service of the target device to crash.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-401

Affected software

No affected versions have been published.

Timeline

Published: Nov 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-41236.5livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-412308.8Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are no CVE-2021-412317.2OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via Dat CVE-2021-412329.8Thunderdome is an open source agile planning poker tool in the theme of Battling for points. In affected versions there is an LDAP injection CVE-2021-412335.3Nextcloud text is a collaborative document editing using Markdown built for the nextcloud server. Due to an issue with the Nextcloud Text ap CVE-2021-412364.8OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to em CVE-2021-412387.5Hangfire is an open source system to perform background job processing in a .NET or .NET Core applications. No Windows Service or separate p CVE-2021-412395.3Nextcloud server is a self hosted system designed to provide cloud style services. In affected versions the User Status API did not consider CVE-2021-41246.1janus-gateway is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2021-412414.3Nextcloud server is a self hosted system designed to provide cloud style services. The groupfolders application for Nextcloud allows sharing CVE-2021-412428.1OpenOlat is a web-basedlearning management system. A path traversal vulnerability exists in OpenOlat prior to versions 15.5.12 and 16.0.5. B CVE-2021-412438.8There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissi