CVE catalog

CVE-2021-44686

calibre affected and fixed versions

[CVE catalog]

calibre before 5.32.0 contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service) in html_preprocess_rules in ebooks/conversion/preprocess.py.

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
5.21% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / releasePackageVersionStatusSource
Debiantrixiecalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debiantrixiecalibre8.5.0+ds-1+deb13u3Fixed[CVE-2021-44686]
Debiansidcalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debiansidcalibre9.17.0+ds+~1.1.2-1Fixed[CVE-2021-44686]
Debianforkycalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debianforkycalibre9.17.0+ds+~1.1.2-1Fixed[CVE-2021-44686]
Debianbookworm-securitycalibre6.13.0+repack-2+deb12u10Fixed[CVE-2021-44686]
Debianbookwormcalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debianbookwormcalibre6.13.0+repack-2+deb12u9Fixed[CVE-2021-44686]

Showing 9 fix observations. All 67 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence
Distribution / releasePackageVersionStatusSource
Debianbookwormcalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debianbookwormcalibre6.13.0+repack-2+deb12u9Fixed[CVE-2021-44686]
Debianbookworm-securitycalibre6.13.0+repack-2+deb12u10Fixed[CVE-2021-44686]
Debianforkycalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debianforkycalibre9.17.0+ds+~1.1.2-1Fixed[CVE-2021-44686]
Debiansidcalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debiansidcalibre9.17.0+ds+~1.1.2-1Fixed[CVE-2021-44686]
Debiantrixiecalibre5.33.0+dfsg-1FixedDistribution-reported fixed boundary[CVE-2021-44686]
Debiantrixiecalibre8.5.0+ds-1+deb13u3Fixed[CVE-2021-44686]
Ubuntu16.04calibre2.33.0+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.38.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.45.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.45.0+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.48.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.48.0+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.54.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.55.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu16.04calibre2.55.0+dfsg-1ubuntu0.2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.12.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.13.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.14.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.15.0.1+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.16.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.16.0+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.17.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.17.0+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.18.0+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.19.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.20.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.21.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.21.0+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.7.0+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu18.04calibre3.7.0+dfsg-2build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre3.46.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.2.0+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.3.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.3.0+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.4.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.5.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.5.0+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.5.0+dfsg-3UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.6.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.7.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.3+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg+really4.10.0+py3-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg+really4.11.2-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg+really4.11.2-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg+really4.12.0-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg+really4.12.0-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg+really4.12.0-1ubuntu1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu20.04calibre4.99.4+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu22.04calibre5.25.0+dfsg-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu22.04calibre5.33.2+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu22.04calibre5.34.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu22.04calibre5.35.0+dfsg-1ubuntu2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu22.04calibre5.37.0+dfsg-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu22.04calibre5.37.0+dfsg-1build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.13.0+ds+~0.10.5-3UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.14.0+ds+~0.10.5-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.15.0+ds+~0.10.5-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.16.0+ds+~0.10.5-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.16.2+ds+~0.10.5-1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.16.2+ds+~0.10.5-2UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.16.2+ds+~0.10.5-3UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre8.8.0+ds-3build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Ubuntu26.04calibre9.2.1+ds+~0.10.5-2build1UnknownSource applicability is not established[UBUNTU-CVE-2021-44686]
Original provider fields
{
  "package_releases": [
    {
      "name": "calibre",
      "status": "fixed",
      "release": "sid",
      "version": "9.17.0+ds+~1.1.2-1"
    },
    {
      "name": "calibre",
      "status": "fixed",
      "release": "forky",
      "version": "9.17.0+ds+~1.1.2-1"
    },
    {
      "name": "calibre",
      "status": "fixed",
      "release": "trixie",
      "version": "8.5.0+ds-1+deb13u3"
    },
    {
      "name": "calibre",
      "status": "fixed",
      "release": "bookworm",
      "version": "6.13.0+repack-2+deb12u9"
    },
    {
      "name": "calibre",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "6.13.0+repack-2+deb12u10"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "calibre",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.33.0+dfsg-1"
    },
    {
      "bug": null,
      "name": "calibre",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.33.0+dfsg-1"
    },
    {
      "bug": null,
      "name": "calibre",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.33.0+dfsg-1"
    },
    {
      "bug": null,
      "name": "calibre",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "5.33.0+dfsg-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "calibre",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "2.33.0+dfsg-1build1",
        "2.38.0+dfsg-1",
        "2.45.0+dfsg-1",
        "2.45.0+dfsg-1build1",
        "2.48.0+dfsg-1",
        "2.48.0+dfsg-1build1",
        "2.54.0+dfsg-1",
        "2.55.0+dfsg-1",
        "2.55.0+dfsg-1ubuntu0.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-44686",
      "provider_updated_at": "2026-05-20T16:05:20.586193063Z",
      "applicability_unknown": true
    },
    {
      "name": "calibre",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "3.7.0+dfsg-2",
        "3.7.0+dfsg-2build1",
        "3.12.0+dfsg-1",
        "3.13.0+dfsg-1",
        "3.14.0+dfsg-1",
        "3.15.0.1+dfsg-1",
        "3.16.0+dfsg-1",
        "3.16.0+dfsg-1build1",
        "3.17.0+dfsg-1",
        "3.17.0+dfsg-2",
        "3.18.0+dfsg-1build1",
        "3.19.0+dfsg-1",
        "3.20.0+dfsg-1",
        "3.21.0+dfsg-1",
        "3.21.0+dfsg-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-44686",
      "provider_updated_at": "2026-05-20T16:05:20.586193063Z",
      "applicability_unknown": true
    },
    {
      "name": "calibre",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "3.46.0+dfsg-1",
        "4.2.0+dfsg-2",
        "4.3.0+dfsg-1",
        "4.3.0+dfsg-2",
        "4.4.0+dfsg-1",
        "4.5.0+dfsg-1",
        "4.5.0+dfsg-2",
        "4.5.0+dfsg-3",
        "4.6.0+dfsg-1",
        "4.7.0+dfsg-1",
        "4.99.3+dfsg-2",
        "4.99.4+dfsg-1",
        "4.99.4+dfsg-1build1",
        "4.99.4+dfsg+really4.10.0+py3-2",
        "4.99.4+dfsg+really4.11.2-1",
        "4.99.4+dfsg+really4.11.2-1build1",
        "4.99.4+dfsg+really4.12.0-1",
        "4.99.4+dfsg+really4.12.0-1build1",
        "4.99.4+dfsg+really4.12.0-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-44686",
      "provider_updated_at": "2026-05-20T16:05:20.586193063Z",
      "applicability_unknown": true
    },
    {
      "name": "calibre",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "5.25.0+dfsg-2",
        "5.33.2+dfsg-1",
        "5.34.0+dfsg-1",
        "5.35.0+dfsg-1ubuntu2",
        "5.37.0+dfsg-1",
        "5.37.0+dfsg-1build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-44686",
      "provider_updated_at": "2026-05-20T16:05:20.586193063Z",
      "applicability_unknown": true
    },
    {
      "name": "calibre",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "8.8.0+ds-3build1",
        "8.13.0+ds+~0.10.5-3",
        "8.14.0+ds+~0.10.5-1",
        "8.15.0+ds+~0.10.5-1",
        "8.16.0+ds+~0.10.5-2",
        "8.16.2+ds+~0.10.5-1",
        "8.16.2+ds+~0.10.5-2",
        "8.16.2+ds+~0.10.5-3",
        "9.2.1+ds+~0.10.5-2build1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-44686",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-44686",
      "provider_updated_at": "2026-05-20T16:05:20.586193063Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [calibre]Unknown
    Details (4)
    • 6.13.0+repack-2+deb12u9 · all · bookworm

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

    • 6.13.0+repack-2+deb12u9 · all · bookworm

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

    • 6.13.0+repack-2+deb12u10 · all · bookworm-security

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

    • 6.13.0+repack-2+deb12u10 · all · bookworm-security

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

  • [calibre-bin]Unknown

    Source package: [calibre]

    Details (4)
    • 6.13.0+repack-2+deb12u9 · amd64 · bookworm

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

    • 6.13.0+repack-2+deb12u9 · arm64 · bookworm

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

    • 6.13.0+repack-2+deb12u10 · amd64 · bookworm-security

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

    • 6.13.0+repack-2+deb12u10 · arm64 · bookworm-security

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · bookworm; dsa · calibre · debian · 12

[Debian 13 (Trixie)]

  • [calibre]Unknown
    Details (4)
    • 8.5.0+ds-1+deb13u3 · all · trixie

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

    • 8.5.0+ds-1+deb13u3 · all · trixie

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

    • 8.16.2+ds+~0.10.5-3~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

    • 8.16.2+ds+~0.10.5-3~bpo13+1 · all · trixie-backports

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

  • [calibre-bin]Unknown

    Source package: [calibre]

    Details (4)
    • 8.5.0+ds-1+deb13u3 · amd64 · trixie

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

    • 8.5.0+ds-1+deb13u3 · arm64 · trixie

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

    • 8.16.2+ds+~0.10.5-3~bpo13+1 · amd64 · trixie-backports

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

    • 8.16.2+ds+~0.10.5-3~bpo13+1 · arm64 · trixie-backports

      Fixed · Fixed: 5.33.0+dfsg-1

      dsa · calibre · debian · 13

Observed:

References