CVE catalog

CVE-2021-4070

golang-v2ray-core: CVE-2021-4070

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.86% · Oct 25, 2026

Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangolang-v2ray-coresid4.34.0+ds-6fixed
Debiangolang-v2ray-coreforky4.34.0+ds-6fixed
Debiangolang-v2ray-coretrixie4.34.0+ds-4fixed
Debiangolang-v2ray-corebookworm4.34.0+ds-1fixed
Ubuntugolang-v2ray-core22.044.34.0-1vulnerable
Ubuntugolang-v2ray-core22.044.34.0-5vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangolang-v2ray-coresourcesid4.34.0-7not yet assignedNot reported[1010377]
Debiangolang-v2ray-coresourceforky4.34.0-7not yet assignedNot reported[1010377]
Debiangolang-v2ray-coresourcetrixie4.34.0-7not yet assignedNot reported[1010377]
Debiangolang-v2ray-coresourcebookworm4.34.0-7not yet assignedNot reported[1010377]

[Debian bug #1010377]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [golang-v2ray-core-dev]Fixed

    Source package: [golang-v2ray-core]

    Details (2)

    • 4.34.0+ds-1 · all · bookworm

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · bookworm; dsa · golang-v2ray-core · debian · 12

    • 4.34.0+ds-1 · all · bookworm

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · bookworm; dsa · golang-v2ray-core · debian · 12

  • [v2ray]Fixed

    Source package: [golang-v2ray-core]

    Details (2)

    • 4.34.0+ds-1 · amd64 · bookworm

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · bookworm; dsa · golang-v2ray-core · debian · 12

    • 4.34.0+ds-1 · arm64 · bookworm

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · bookworm; dsa · golang-v2ray-core · debian · 12

[Debian 13 (Trixie)]

  • [golang-v2ray-core-dev]Fixed

    Source package: [golang-v2ray-core]

    Details (2)

    • 4.34.0+ds-4 · all · trixie

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · 13

    • 4.34.0+ds-4 · all · trixie

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · 13

  • [v2ray]Fixed

    Source package: [golang-v2ray-core]

    Details (2)

    • 4.34.0+ds-4+b12 · amd64 · trixie

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · 13

    • 4.34.0+ds-4+b12 · arm64 · trixie

      Fixed · Fixed: 4.34.0-7

      dsa · golang-v2ray-core · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]