CVE-2021-45918

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

NHI’s health insurance web service component has insufficient validation for input string length, which can result in heap-based buffer overflow attack. A remote attacker can exploit this vulnerability to flood the memory space reserved for the program, in order to terminate service without authentication, which requires a system restart to recover service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-122CWE-1284

Affected software

VendorProductVersions
NHIhealth insurance web service component515BE7DE5BCE446177FEE8A6E0665093
NHIhealth insurance web service component42fcc36541e716e23de77d5f325b186a
NHIhealth insurance web service component52EACB7CA2B4D0A5A869DF01079BF4D6
NHIhealth insurance web service component52EACB7CA2B4D0A5A869DF01079BF4D6

References

Timeline

Published
Jun 20, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-459195.4Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.CVE-2021-459255.3Observable discrepancies in the login process allow an attacker to guess legitimate user names registered in the BMC. This issue affects: LaCVE-2021-459267.8MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd0c689be0) in mdb_numeric_to_string (called from mdb_xfer_bound_daCVE-2021-459277.8MDB Tools (aka mdbtools) 0.9.2 has a stack-based buffer overflow (at 0x7ffd6e029ee0) in mdb_numeric_to_string (called from mdb_xfer_bound_daCVE-2021-459285.5libjxl b02d6b9, as used in libvips 8.11 through 8.11.2 and other products, has an out-of-bounds write in jxl::ModularFrameDecoder::DecodeGroCVE-2021-459295.5Wasm3 0.5.0 has an out-of-bounds write in CompileBlock (called from CompileElseBlock and Compile_If).CVE-2021-459305.5Qt SVG in Qt 5.0.0 through 5.15.2 and 6.0.0 through 6.2.1 has an out-of-bounds write in QtPrivate::QCommonArrayOps<QPainterPath::Element>::gCVE-2021-459316.5HarfBuzz 2.9.0 has an out-of-bounds write in hb_bit_set_invertible_t::set (called from hb_sparseset_t<hb_bit_set_invertible_t>::set and hb_sCVE-2021-459325.5wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (4 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HaCVE-2021-459335.5wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (8 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HaCVE-2021-459345.5wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_DecodePacket (called from MqttClient_HandlePacket and MqttClient_WaitTypCVE-2021-459355.5Grok 9.5.0 has a heap-based buffer overflow in openhtj2k::T1OpenHTJ2K::decompress (called from std::__1::__packaged_task_func<std::__1::__bi
CVE-2021-45918: High severity, CVSS 7.5 | Vulnix