CVE-2021-4213
HIGHNetwork Security Services for Java < 4.9.3 - Use-After-Free
Title source: llmDescription
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.
References (5)
Core 5
Core References
Issue Tracking, Patch, Third Party Advisory x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=2042900
Third Party Advisory x_refsource_misc
https://access.redhat.com/security/cve/CVE-2021-4213
Third Party Advisory x_refsource_misc
https://security-tracker.debian.org/tracker/CVE-2021-4213
Patch, Third Party Advisory x_refsource_misc
https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448
Patch, Third Party Advisory x_refsource_misc
https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2
Scores
CVSS v3
7.5
EPSS
0.0024
EPSS Percentile
46.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-401
Status
published
Products (4)
debian/debian_linux
10.0
debian/debian_linux
11.0
dogtagpki/network_security_services_for_java
< 4.9.3
redhat/enterprise_linux
8.0
Published
Aug 24, 2022
Tracked Since
Feb 18, 2026