CVE-2021-41396

HIGH

live555 < 1.08 - Denial of Service via Socket Connection Overflow

Title source: llm

Description

Live555 through 1.08 does not handle socket connections properly. A huge number of incoming socket connections in a short time invokes the error-handling module, in which a heap-based buffer overflow happens. An attacker can leverage this to launch a DoS attack.

References (2)

Core 2

Core References

Release Notes, Vendor Advisory x_refsource_misc

http://www.live555.com/liveMedia/public/changelog.txt

Exploit, Mailing List, Vendor Advisory x_refsource_misc

http://lists.live555.com/pipermail/live-devel/2021-September/021994.html

Scores

CVSS v3 7.5

EPSS 0.0117

EPSS Percentile 63.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

CWE

CWE-787

Status published

Products (1)

live555/live555 < 1.08

Published Jul 12, 2022

Tracked Since Feb 18, 2026