
CVE catalog
CVE-2021-44686
calibre affected and fixed versions
calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 5.21% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debiantrixie | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debiantrixie | calibre | 8.5.0+ds-1+deb13u3 | Fixed | [CVE-2021-44686] |
| Debiansid | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debiansid | calibre | 9.17.0+ds+~1.1.2-1 | Fixed | [CVE-2021-44686] |
| Debianforky | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debianforky | calibre | 9.17.0+ds+~1.1.2-1 | Fixed | [CVE-2021-44686] |
| Debianbookworm-security | calibre | 6.13.0+repack-2+deb12u10 | Fixed | [CVE-2021-44686] |
| Debianbookworm | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debianbookworm | calibre | 6.13.0+repack-2+deb12u9 | Fixed | [CVE-2021-44686] |
Showing 9 fix observations. All 67 observations, including unknown and conflicting reports, are available below.
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debianbookworm | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debianbookworm | calibre | 6.13.0+repack-2+deb12u9 | Fixed | [CVE-2021-44686] |
| Debianbookworm-security | calibre | 6.13.0+repack-2+deb12u10 | Fixed | [CVE-2021-44686] |
| Debianforky | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debianforky | calibre | 9.17.0+ds+~1.1.2-1 | Fixed | [CVE-2021-44686] |
| Debiansid | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debiansid | calibre | 9.17.0+ds+~1.1.2-1 | Fixed | [CVE-2021-44686] |
| Debiantrixie | calibre | 5.33.0+dfsg-1 | FixedDistribution-reported fixed boundary | [CVE-2021-44686] |
| Debiantrixie | calibre | 8.5.0+ds-1+deb13u3 | Fixed | [CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.33.0+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.38.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.45.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.45.0+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.48.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.48.0+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.54.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.55.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu16.04 | calibre | 2.55.0+dfsg-1ubuntu0.2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.12.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.13.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.14.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.15.0.1+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.16.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.16.0+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.17.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.17.0+dfsg-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.18.0+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.19.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.20.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.21.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.21.0+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.7.0+dfsg-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu18.04 | calibre | 3.7.0+dfsg-2build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 3.46.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.2.0+dfsg-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.3.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.3.0+dfsg-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.4.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.5.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.5.0+dfsg-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.5.0+dfsg-3 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.6.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.7.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.3+dfsg-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg+really4.10.0+py3-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg+really4.11.2-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg+really4.11.2-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg+really4.12.0-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg+really4.12.0-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg+really4.12.0-1ubuntu1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu20.04 | calibre | 4.99.4+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu22.04 | calibre | 5.25.0+dfsg-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu22.04 | calibre | 5.33.2+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu22.04 | calibre | 5.34.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu22.04 | calibre | 5.35.0+dfsg-1ubuntu2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu22.04 | calibre | 5.37.0+dfsg-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu22.04 | calibre | 5.37.0+dfsg-1build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.13.0+ds+~0.10.5-3 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.14.0+ds+~0.10.5-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.15.0+ds+~0.10.5-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.16.0+ds+~0.10.5-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.16.2+ds+~0.10.5-1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.16.2+ds+~0.10.5-2 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.16.2+ds+~0.10.5-3 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 8.8.0+ds-3build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
| Ubuntu26.04 | calibre | 9.2.1+ds+~0.10.5-2build1 | UnknownSource applicability is not established | [UBUNTU-CVE-2021-44686] |
Original provider fields
{
"package_releases": [
{
"name": "calibre",
"status": "fixed",
"release": "sid",
"version": "9.17.0+ds+~1.1.2-1"
},
{
"name": "calibre",
"status": "fixed",
"release": "forky",
"version": "9.17.0+ds+~1.1.2-1"
},
{
"name": "calibre",
"status": "fixed",
"release": "trixie",
"version": "8.5.0+ds-1+deb13u3"
},
{
"name": "calibre",
"status": "fixed",
"release": "bookworm",
"version": "6.13.0+repack-2+deb12u9"
},
{
"name": "calibre",
"status": "fixed",
"release": "bookworm-security",
"version": "6.13.0+repack-2+deb12u10"
}
],
"fixed_versions": [
{
"bug": null,
"name": "calibre",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "5.33.0+dfsg-1"
},
{
"bug": null,
"name": "calibre",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "5.33.0+dfsg-1"
},
{
"bug": null,
"name": "calibre",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "5.33.0+dfsg-1"
},
{
"bug": null,
"name": "calibre",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": "5.33.0+dfsg-1"
}
],
"distribution_packages": [
{
"name": "calibre",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "16.04",
"versions": [
"2.33.0+dfsg-1build1",
"2.38.0+dfsg-1",
"2.45.0+dfsg-1",
"2.45.0+dfsg-1build1",
"2.48.0+dfsg-1",
"2.48.0+dfsg-1build1",
"2.54.0+dfsg-1",
"2.55.0+dfsg-1",
"2.55.0+dfsg-1ubuntu0.2"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2021-44686",
"provider_updated_at": "2026-05-20T16:05:20.586193063Z",
"applicability_unknown": true
},
{
"name": "calibre",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"3.7.0+dfsg-2",
"3.7.0+dfsg-2build1",
"3.12.0+dfsg-1",
"3.13.0+dfsg-1",
"3.14.0+dfsg-1",
"3.15.0.1+dfsg-1",
"3.16.0+dfsg-1",
"3.16.0+dfsg-1build1",
"3.17.0+dfsg-1",
"3.17.0+dfsg-2",
"3.18.0+dfsg-1build1",
"3.19.0+dfsg-1",
"3.20.0+dfsg-1",
"3.21.0+dfsg-1",
"3.21.0+dfsg-1build1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2021-44686",
"provider_updated_at": "2026-05-20T16:05:20.586193063Z",
"applicability_unknown": true
},
{
"name": "calibre",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"3.46.0+dfsg-1",
"4.2.0+dfsg-2",
"4.3.0+dfsg-1",
"4.3.0+dfsg-2",
"4.4.0+dfsg-1",
"4.5.0+dfsg-1",
"4.5.0+dfsg-2",
"4.5.0+dfsg-3",
"4.6.0+dfsg-1",
"4.7.0+dfsg-1",
"4.99.3+dfsg-2",
"4.99.4+dfsg-1",
"4.99.4+dfsg-1build1",
"4.99.4+dfsg+really4.10.0+py3-2",
"4.99.4+dfsg+really4.11.2-1",
"4.99.4+dfsg+really4.11.2-1build1",
"4.99.4+dfsg+really4.12.0-1",
"4.99.4+dfsg+really4.12.0-1build1",
"4.99.4+dfsg+really4.12.0-1ubuntu1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2021-44686",
"provider_updated_at": "2026-05-20T16:05:20.586193063Z",
"applicability_unknown": true
},
{
"name": "calibre",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "22.04",
"versions": [
"5.25.0+dfsg-2",
"5.33.2+dfsg-1",
"5.34.0+dfsg-1",
"5.35.0+dfsg-1ubuntu2",
"5.37.0+dfsg-1",
"5.37.0+dfsg-1build1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2021-44686",
"provider_updated_at": "2026-05-20T16:05:20.586193063Z",
"applicability_unknown": true
},
{
"name": "calibre",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "26.04",
"versions": [
"8.8.0+ds-3build1",
"8.13.0+ds+~0.10.5-3",
"8.14.0+ds+~0.10.5-1",
"8.15.0+ds+~0.10.5-1",
"8.16.0+ds+~0.10.5-2",
"8.16.2+ds+~0.10.5-1",
"8.16.2+ds+~0.10.5-2",
"8.16.2+ds+~0.10.5-3",
"9.2.1+ds+~0.10.5-2build1"
],
"ecosystem": "deb",
"provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
"fixed_version": "",
"provider_source": "pypi",
"provider_record_id": "UBUNTU-CVE-2021-44686",
"provider_updated_at": "2026-05-20T16:05:20.586193063Z",
"applicability_unknown": true
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [calibre]Unknown
Details (4)
6.13.0+repack-2+deb12u9· all · bookwormFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
6.13.0+repack-2+deb12u9· all · bookwormFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
6.13.0+repack-2+deb12u10· all · bookworm-securityFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
6.13.0+repack-2+deb12u10· all · bookworm-securityFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
- [calibre-bin]Unknown
Source package: [calibre]
Details (4)
6.13.0+repack-2+deb12u9· amd64 · bookwormFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
6.13.0+repack-2+deb12u9· arm64 · bookwormFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
6.13.0+repack-2+deb12u10· amd64 · bookworm-securityFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
6.13.0+repack-2+deb12u10· arm64 · bookworm-securityFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · bookworm; dsa · calibre · debian · 12
[Debian 13 (Trixie)]
- [calibre]Unknown
Details (4)
8.5.0+ds-1+deb13u3· all · trixieFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
8.5.0+ds-1+deb13u3· all · trixieFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
8.16.2+ds+~0.10.5-3~bpo13+1· all · trixie-backportsFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
8.16.2+ds+~0.10.5-3~bpo13+1· all · trixie-backportsFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
- [calibre-bin]Unknown
Source package: [calibre]
Details (4)
8.5.0+ds-1+deb13u3· amd64 · trixieFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
8.5.0+ds-1+deb13u3· arm64 · trixieFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
8.16.2+ds+~0.10.5-3~bpo13+1· amd64 · trixie-backportsFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
8.16.2+ds+~0.10.5-3~bpo13+1· arm64 · trixie-backportsFixed · Fixed:
5.33.0+dfsg-1dsa · calibre · debian · 13
Observed:
References
- [https://osv.dev/vulnerability/DEBIAN-CVE-2021-44686]
- [https://osv.dev/vulnerability/DLA-3862-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686]
- [https://security-tracker.debian.org/tracker/CVE-2021-44686]
- [https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-44686.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]