CVE catalog

CVE-2021-44540

privoxy: CVE-2021-44540

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.36% · Oct 25, 2026

A vulnerability was found in Privoxy which was fixed in get_url_spec_param() by freeing memory of compiled pattern spec before bailing.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianprivoxysid4.2.0-3fixed
Debianprivoxyforky4.2.0-3fixed
Debianprivoxytrixie4.0.0-2fixed
Debianprivoxybookworm3.0.34-1fixed
Alpineprivoxy3.123.0.33-r0fixed
Alpineprivoxy3.133.0.33-r0fixed
Alpineprivoxy3.143.0.33-r0fixed
Alpineprivoxy3.153.0.33-r0fixed
Alpineprivoxy3.163.0.33-r0fixed
Alpineprivoxy3.173.0.33-r0fixed
Alpineprivoxy3.183.0.33-r0fixed
Alpineprivoxy3.193.0.33-r0fixed
Alpineprivoxy3.203.0.33-r0fixed
Alpineprivoxy3.213.0.33-r0fixed
Alpineprivoxy3.223.0.33-r0fixed
Alpineprivoxy3.233.0.33-r0fixed
Alpineprivoxy3.243.0.33-r0fixed
Ubuntuprivoxy18.043.0.26-3vulnerable
Ubuntuprivoxy18.043.0.26-4vulnerable
Ubuntuprivoxy18.043.0.26-5vulnerable
Ubuntuprivoxy18.043.0.26-5ubuntu0.1vulnerable
Ubuntuprivoxy18.043.0.26-5ubuntu0.3fixed
Ubuntuprivoxy20.043.0.28-2vulnerable
Ubuntuprivoxy20.043.0.28-2ubuntu0.1vulnerable
Ubuntuprivoxy20.043.0.28-2ubuntu0.2fixed
Suseprivoxypackage hub 15 sp43.0.33-bp154.3.3.1fixed
Opensuseprivoxyleap 15.43.0.33-bp154.3.3.1fixed
Opensuseprivoxytumbleweed3.0.33-1.1fixed
Ubuntuprivoxypro3.0.21-1vulnerable
Ubuntuprivoxypro3.0.21-2vulnerable
Ubuntuprivoxypro3.0.21-7+deb8u1build0.14.04.1vulnerable
Ubuntuprivoxypro3.0.21-7+deb8u1ubuntu0.1~esm1vulnerable
Ubuntuprivoxy16.043.0.23-3vulnerable
Ubuntuprivoxy16.043.0.23-4vulnerable
Ubuntuprivoxy16.043.0.23-5vulnerable
Ubuntuprivoxy16.043.0.24-1vulnerable
Ubuntuprivoxy16.043.0.24-1ubuntu0.1vulnerable
Ubuntuprivoxy18.043.0.26-3vulnerable
Ubuntuprivoxy18.043.0.26-4vulnerable
Ubuntuprivoxy18.043.0.26-5vulnerable
Ubuntuprivoxy18.043.0.26-5ubuntu0.1vulnerable
Ubuntuprivoxy18.043.0.26-5ubuntu0.3fixed
Ubuntuprivoxy20.043.0.28-2vulnerable
Ubuntuprivoxy20.043.0.28-2ubuntu0.1vulnerable
Ubuntuprivoxy20.043.0.28-2ubuntu0.2fixed
Suseprivoxypackage hub 15 sp33.0.33-bp153.2.3.1fixed
Opensuseprivoxyleap 15.23.0.33-bp153.2.3.1fixed
Opensuseprivoxyleap 15.33.0.33-bp153.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianprivoxysourcesid3.0.33-1not yet assignedNot reportedNot reported
Debianprivoxysourceforky3.0.33-1not yet assignedNot reportedNot reported
Debianprivoxysourcetrixie3.0.33-1not yet assignedNot reportedNot reported
Debianprivoxysourcebookworm3.0.33-1not yet assignedNot reportedNot reported
Alpineprivoxyapk3.123.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.133.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.143.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.153.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.163.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.173.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.183.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.193.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.203.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.213.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.223.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.233.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Alpineprivoxyapk3.243.0.33-r0Not reportedALPINE-CVE-2021-44540Not reported
Ubuntuprivoxydeb18.043.0.26-5ubuntu0.3Not reportedUSN-5826-1Not reported
Ubuntuprivoxydeb20.043.0.28-2ubuntu0.2Not reportedUSN-5826-1Not reported
Suseprivoxyrpmpackage hub 15 sp43.0.33-bp154.3.3.1Not reportedOPENSUSE-SU-2022:10186-1Not reported
Opensuseprivoxyrpmleap 15.43.0.33-bp154.3.3.1Not reportedOPENSUSE-SU-2022:10186-1Not reported
Opensuseprivoxyrpmtumbleweed3.0.33-1.1Not reportedOPENSUSE-SU-2024:11677-1Not reported
Ubuntuprivoxydeb18.043.0.26-5ubuntu0.3Not reportedUBUNTU-CVE-2021-44540Not reported
Ubuntuprivoxydeb20.043.0.28-2ubuntu0.2Not reportedUBUNTU-CVE-2021-44540Not reported
Suseprivoxyrpmpackage hub 15 sp33.0.33-bp153.2.3.1Not reportedOPENSUSE-SU-2021:1646-1Not reported
Opensuseprivoxyrpmleap 15.23.0.33-bp153.2.3.1Not reportedOPENSUSE-SU-2021:1646-1Not reported
Opensuseprivoxyrpmleap 15.33.0.33-bp153.2.3.1Not reportedOPENSUSE-SU-2021:1646-1Not reported

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [privoxy-doc]Unknown

    Source package: [privoxy]

    Details (1)

    • 4.2.0-1.3 · noarch · tumbleweed

      Unknown · Fixed: 3.0.33-1.1

      Version impact unknown

      dsa · privoxy · opensuse · tumbleweed

  • [privoxy]Fixed

    Source package: [privoxy]

    Details (1)

    • 4.2.0-1.3 · x86_64 · tumbleweed

      Fixed · Fixed: 3.0.33-1.1

      dsa · privoxy · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [privoxy]Fixed
    Details (2)

    • 3.0.34-1 · amd64 · bookworm

      Fixed · Fixed: 3.0.33-1

      dsa · privoxy · debian · bookworm; dsa · privoxy · debian · 12

    • 3.0.34-1 · arm64 · bookworm

      Fixed · Fixed: 3.0.33-1

      dsa · privoxy · debian · bookworm; dsa · privoxy · debian · 12

[Debian 13 (Trixie)]

  • [privoxy]Fixed
    Details (2)

    • 4.0.0-2 · amd64 · trixie

      Fixed · Fixed: 3.0.33-1

      dsa · privoxy · debian · 13

    • 4.0.0-2 · arm64 · trixie

      Fixed · Fixed: 3.0.33-1

      dsa · privoxy · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]