CVE-2021-4213

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

Vendor	Product	Versions
n/a	JSS	Fixed in v5.2.0-beta1

References

https://access.redhat.com/security/cve/CVE-2021-4213Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2042900Issue Tracking, Patch, Third Party Advisory
https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2Patch, Third Party Advisory
https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2021-4213Third Party Advisory
https://access.redhat.com/security/cve/CVE-2021-4213Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2042900Issue Tracking, Patch, Third Party Advisory
https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2Patch, Third Party Advisory
https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448Patch, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2021-4213Third Party Advisory

Timeline

Published: Aug 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-421308.8A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Ser CVE-2021-421318.8A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privi CVE-2021-421328.8A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform CVE-2021-421338.1An exposed dangerous function vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service t CVE-2021-421346.1The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021 CVE-2021-421358.1HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Clo CVE-2021-421369.0A stored Cross-Site Scripting (XSS) vulnerability in the Missing Data Codes functionality of REDCap before 11.4.0 allows remote attackers to CVE-2021-421375.3An issue was discovered in Zammad before 5.0.1. In some cases, there is improper enforcement of the privilege requirement for viewing a list CVE-2021-421386.5A user of a machine protected by SafeNet Agent for Windows Logon may leverage weak entropy to access the encrypted credentials of any or all CVE-2021-421399.8Deno Standard Modules before 0.107.0 allows Code Injection via an untrusted YAML file in certain configurations.CVE-2021-42145.5A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially cr CVE-2021-421419.8An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. One incorrect handshake could complete with different epoch numbers in th