CVE-2021-44758

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/heimdal/heimdal/commit/f9ec7002cdd526ae84fbacbf153162e118f22580Patch, Third Party Advisory
https://github.com/heimdal/heimdal/security/advisories/GHSA-69h9-669w-88xvThird Party Advisory
https://security.gentoo.org/glsa/202310-06
https://github.com/heimdal/heimdal/commit/f9ec7002cdd526ae84fbacbf153162e118f22580Patch, Third Party Advisory
https://github.com/heimdal/heimdal/security/advisories/GHSA-69h9-669w-88xvThird Party Advisory
https://security.gentoo.org/glsa/202310-06

Timeline

Published: Dec 26, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-447598.1Improper Authentication vulnerability in TLS origin validation of Apache Traffic Server allows an attacker to create a man in the middle att CVE-2021-447605.4Auth. (admin+) Reflected Cross-Site Scripting (XSS) vulnerability discovered in WP-DownloadManager plugin <= 1.68.6 versions.CVE-2021-447685.5Delta Electronics CNCSoft (Version 1.01.30) and prior) is vulnerable to an out-of-bounds read while processing a specific project file, whic CVE-2021-447696.5An improper input validation vulnerability in the TLS certificate generation function allows an attacker to cause a Denial-of-Service (DoS) CVE-2021-44779.1Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN CVE-2021-447756.1Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attac CVE-2021-447765.3A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the se CVE-2021-447774.3Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress pl CVE-2021-447799.8Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&lis CVE-2021-44788.2Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-bounds write vulnerability when loading .gdt CVE-2021-44794.0Dräger Atlan A350 versions 1.00 up to and including 1.01 contains an improper input handling vulnerability that allows attackers to cause a CVE-2021-447909.8A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Ap