Catalogo CVE

CVE-2021-33913

libspf2 affected and fixed versions

libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supply chain of a site's e-mail infrastructure (e.g., with additional configuration, Exim can use libspf2; the Postfix web site links to unofficial patches for use of libspf2 with Postfix; older versions of spfquery relied on libspf2) but most often is not.

Gravità: Medium
Published: Jan 1, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 9.64% · Oct 27, 2026

Projects and upstream resources

[libspf2][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debiantrixie	libspf2	`1.2.10-8.3`	Fixed	[CVE-2021-33913]
Debiansid	libspf2	`1.2.10-11`	Fixed	[CVE-2021-33913]
Debiansid	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debianforky	libspf2	`1.2.10-11`	Fixed	[CVE-2021-33913]
Debianforky	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debianbookworm	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debianbookworm	libspf2	`1.2.10-7.2`	Fixed	[CVE-2021-33913]

Showing 8 fix observations. All 24 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Alpine3.14	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.15	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.16	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.17	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.18	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.19	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.20	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.21	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.22	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.23	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Alpine3.24	libspf2	`1.2.11-r0`	UnknownSource applicability is not established	[ALPINE-CVE-2021-33913]Oct 23, 2026, 5:17:56 PM UTC
Debianbookworm	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debianbookworm	libspf2	`1.2.10-7.2`	Fixed	[CVE-2021-33913]
Debianforky	libspf2	`1.2.10-11`	Fixed	[CVE-2021-33913]
Debianforky	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debiansid	libspf2	`1.2.10-11`	Fixed	[CVE-2021-33913]
Debiansid	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debiantrixie	libspf2	`1.2.10-7.1`	FixedDistribution-reported fixed boundary	[CVE-2021-33913]
Debiantrixie	libspf2	`1.2.10-8.3`	Fixed	[CVE-2021-33913]
Ubuntu20.04	libspf2	`1.2.10-7+deb9u2build0.20.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-33913]Apr 22, 2026, 12:55:08 PM UTC
Ubuntu20.04	libspf2	`1.2.10-7build3`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-33913]Apr 22, 2026, 12:55:08 PM UTC
Ubuntu20.04	libspf2	`1.2.10-7build4`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-33913]Apr 22, 2026, 12:55:08 PM UTC
Ubuntupro	libspf2	`1.2.10-7build2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-33913]Apr 22, 2026, 12:55:08 PM UTC
Ubuntupro	libspf2	`1.2.10-7ubuntu0.18.04.1~esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-33913]Apr 22, 2026, 12:55:08 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "libspf2",
      "status": "fixed",
      "release": "sid",
      "version": "1.2.10-11"
    },
    {
      "name": "libspf2",
      "status": "fixed",
      "release": "forky",
      "version": "1.2.10-11"
    },
    {
      "name": "libspf2",
      "status": "fixed",
      "release": "trixie",
      "version": "1.2.10-8.3"
    },
    {
      "name": "libspf2",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.2.10-7.2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "libspf2",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.10-7.1"
    },
    {
      "bug": null,
      "name": "libspf2",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.10-7.1"
    },
    {
      "bug": null,
      "name": "libspf2",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.10-7.1"
    },
    {
      "bug": null,
      "name": "libspf2",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.2.10-7.1"
    }
  ],
  "distribution_packages": [
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.14",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.15",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.16",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.17",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.18",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.19",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.20",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.21",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.22",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.11-r0"
            }
          ]
        }
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-33913",
      "fixed_version": "1.2.11-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2021-33913",
      "provider_updated_at": "2026-10-23T17:17:56.191304534Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.10-7ubuntu0.18.04.1~esm1"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.2.10-7build2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-33913",
      "fixed_version": "1.2.10-7ubuntu0.18.04.1~esm1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-33913",
      "provider_updated_at": "2026-04-22T12:55:08.940479Z",
      "applicability_unknown": true
    },
    {
      "name": "libspf2",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.2.10-7+deb9u2build0.20.04.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.2.10-7build3",
        "1.2.10-7build4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-33913",
      "fixed_version": "1.2.10-7+deb9u2build0.20.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-33913",
      "provider_updated_at": "2026-04-22T12:55:08.940479Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

L’associazione dei pacchetti è in corso.

[Debian 12 (Bookworm)]

[libmail-spf-xs-perl]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-7.2+b1 · amd64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
- 1.2.10-7.2+b1 · arm64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
[libspf2-2]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-7.2+b1 · amd64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
- 1.2.10-7.2+b1 · arm64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
[libspf2-2-dbg]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-7.2+b1 · amd64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
- 1.2.10-7.2+b1 · arm64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
[libspf2-dev]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-7.2+b1 · amd64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
- 1.2.10-7.2+b1 · arm64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
[spfquery]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-7.2+b1 · amd64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12
- 1.2.10-7.2+b1 · arm64 · bookworm
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · bookworm; dsa · libspf2 · debian · 12

[Debian 13 (Trixie)]

[libmail-spf-xs-perl]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-8.3 · amd64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13
- 1.2.10-8.3 · arm64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13
[libspf2-2t64]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-8.3 · amd64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13
- 1.2.10-8.3 · arm64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13
[libspf2-dev]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-8.3 · amd64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13
- 1.2.10-8.3 · arm64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13
[spfquery]Sconosciuto
Pacchetto sorgente: [libspf2]
Dettagli (2)
- 1.2.10-8.3 · amd64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13
- 1.2.10-8.3 · arm64 · trixie
  Corretta · Corretta: 1.2.10-7.1
  dsa · libspf2 · debian · 13

Osservato: Oct 23, 2026, 5:58:05 PM UTC

Riferimenti

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]