What is the CVSS score of CVE-2021-28651?

CVE-2021-28651 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 7.4%.

Is there a public PoC exploit available for CVE-2021-28651?

Yes, a public proof-of-concept exploit is available for CVE-2021-28651. Prioritise patching immediately. EPSS: 7.4%.

Is there a patch available for CVE-2021-28651?

Yes, a patch is available for CVE-2021-28651. Update the affected software to the latest version immediately.

Debian Linux CVE-2021-28651

HIGH

Memory Leak (CWE-401)

2021-05-27 cve@mitre.org

Denial Of Service Debian Debian Linux Fedora Squid Cloud Manager Netapp Fedoraproject Squid Cache

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

CVE Published

May 27, 2021 - 12:15 nvd

HIGH 7.5

DescriptionNVD

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption.

AnalysisAI

An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Memory Leak (CWE-401), which allows attackers to exhaust available memory leading to denial of service. An issue was discovered in Squid before 4.15 and 5.x before 5.0.6. Due to a buffer-management bug, it allows a denial of service. When resolving a request with the urn: scheme, the parser leaks a small amount of memory. However, there is an unspecified attack methodology that can easily trigger a large amount of memory consumption. Affected products include: Squid-Cache Squid, Debian Debian Linux, Fedoraproject Fedora, Netapp Cloud Manager. Version information: before 4.15.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Ensure all allocated memory is properly freed. Use RAII patterns or garbage-collected languages.