CVE catalog
CVE-2021-3502
avahi: CVE-2021-3502
- Severity
- Medium · CVSS 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.37% · Oct 25, 2026
A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | avahi | sid | 0.8-18 | fixed |
| Debian | avahi | forky | 0.8-18 | fixed |
| Debian | avahi | trixie | 0.8-16 | fixed |
| Debian | avahi | bookworm | 0.8-10+deb12u1 | fixed |
| Alpine | avahi | 3.18 | 0.8-r5 | fixed |
| Alpine | avahi | 3.19 | 0.8-r5 | fixed |
| Alpine | avahi | 3.20 | 0.8-r5 | fixed |
| Alpine | avahi | 3.21 | 0.8-r5 | fixed |
| Alpine | avahi | 3.22 | 0.8-r5 | fixed |
| Alpine | avahi | 3.23 | 0.8-r5 | fixed |
| Alpine | avahi | 3.24 | 0.8-r5 | fixed |
| Ubuntu | avahi | 22.04 | 0.8-5ubuntu4 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | avahi | source | sid | 0.8-6 | not yet assigned | Not reported | [986018] |
| Debian | avahi | source | forky | 0.8-6 | not yet assigned | Not reported | [986018] |
| Debian | avahi | source | trixie | 0.8-6 | not yet assigned | Not reported | [986018] |
| Debian | avahi | source | bookworm | 0.8-6 | not yet assigned | Not reported | [986018] |
| Alpine | avahi | apk | 3.18 | 0.8-r5 | Not reported | ALPINE-CVE-2021-3502 | Not reported |
| Alpine | avahi | apk | 3.19 | 0.8-r5 | Not reported | ALPINE-CVE-2021-3502 | Not reported |
| Alpine | avahi | apk | 3.20 | 0.8-r5 | Not reported | ALPINE-CVE-2021-3502 | Not reported |
| Alpine | avahi | apk | 3.21 | 0.8-r5 | Not reported | ALPINE-CVE-2021-3502 | Not reported |
| Alpine | avahi | apk | 3.22 | 0.8-r5 | Not reported | ALPINE-CVE-2021-3502 | Not reported |
| Alpine | avahi | apk | 3.23 | 0.8-r5 | Not reported | ALPINE-CVE-2021-3502 | Not reported |
| Alpine | avahi | apk | 3.24 | 0.8-r5 | Not reported | ALPINE-CVE-2021-3502 | Not reported |
| Ubuntu | avahi | deb | 22.04 | 0.8-5ubuntu4 | Not reported | UBUNTU-CVE-2021-3502 | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [avahi-autoipd]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [avahi-daemon]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [avahi-discover]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· all · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· all · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [avahi-dnsconfd]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [avahi-ui-utils]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [avahi-utils]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [gir1.2-avahi-0.6]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-client3]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-client-dev]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-common3]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-common-data]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-common-dev]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-compat-libdnssd1]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-compat-libdnssd-dev]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-core7]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-core-dev]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-glib1]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-glib-dev]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-gobject0]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
- [libavahi-gobject-dev]Fixed
Source package: [avahi]
Details (2)
0.8-10+deb12u1· amd64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
0.8-10+deb12u1· arm64 · bookwormFixed · Fixed:
0.8-6dsa · avahi · debian · bookworm; dsa · avahi · debian · 12
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10643-1.json]
- [https://osv.dev/vulnerability/ALPINE-CVE-2021-3502]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-3502]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-3502]
- [https://security-tracker.debian.org/tracker/CVE-2021-3502]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-3502.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]