CVE-2021-20314
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can...
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
CVE-2021-20314- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
CVE-2021-20314- Updated
- 2026-11-02
EUVDEUVD-2021-7739 No score
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
EUVD-2021-7739- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mf9-xf4j-h63m
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can...
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
GHSA-7mf9-xf4j-h63m- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-20314
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
ALPINE-CVE-2021-20314- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
CVE-2021-20314- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2021-20314
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
DEBIAN-CVE-2021-20314- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-20314
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Record
UBUNTU-CVE-2021-20314- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0414 No score
Updated libspf2 packages fix security vulnerability
A stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages (CVE-2021-20314).
- Record
MGASA-2021-0414- Updated
- 2026-11-02
OSVMGASA-2021-0454 No score
Updated libspf2 packages fix security vulnerability
Updated libspf2 packages fix buffer overflow.
- Record
MGASA-2021-0454- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1187-1 No score
Security update for libspf2
This update for libspf2 fixes the following issue:
- CVE-2021-20314: A remote overflow in SPF parsing could lead to remote code execution (bsc#1189104)
- Record
openSUSE-SU-2021:1187-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10995-1 No score
libspf2-2-1.2.10-5.3 on GA media
These are all security issues fixed in the libspf2-2-1.2.10-5.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10995-1- Updated
- 2026-11-02
OSVUSN-6584-1 No score
libspf2 vulnerabilities
Philipp Jeitner and Haya Shulman discovered that Libspf2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. (CVE-2021-20314)
It was discovered that Libspf2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-33912, CVE-2021-33913)
- Record
USN-6584-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libspf2Alpine:v3.11 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.12 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.13 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.14 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.15 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.16 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.17 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.18 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.19 |
before 1.2.10-r5 | 1.2.10-r5 |
libspf2Alpine:v3.20 |
before 1.2.10-r5 | 1.2.10-r5 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libspf2Alpine:v3.21 |
before 1.2.10-r5 | 1.2.10-r51.2.11-r4 |
libspf2Alpine:v3.22 |
before 1.2.10-r5 | 1.2.10-r51.2.11-r4 |
libspf2Alpine:v3.23 |
before 1.2.10-r5 | 1.2.10-r51.2.11-r4 |
libspf2Alpine:v3.24 |
before 1.2.10-r5 | 1.2.10-r51.2.11-r4 |
libspf2Debian:12 |
before 1.2.10-7.1 | 1.2.10-7.1 |
libspf2Debian:13 |
before 1.2.10-7.1 | 1.2.10-7.1 |
libspf2Debian:14 |
before 1.2.10-7.1 | 1.2.10-7.1 |
libspf2Debian:9 |
before 1.2.10-7+deb9u1, plus listed versions 1.2.10-7 |
1.2.10-7+deb9u1 |
libspf2Debian:10 |
before 1.2.10-7.1~deb10u1, plus listed versions 1.2.10-7 |
1.2.10-7.1~deb10u1 |
libspf2Mageia:8 |
before 1.2.10-5.1.mga8 | 1.2.10-5.1.mga8 |
libspf2Mageia:8 |
before 1.2.11-0.git20210609.1.mga8 | 1.2.11-0.git20210609.1.mga8 |
libspf2Ubuntu:Pro:16.04:LTS |
before 1.2.10-6ubuntu0.1~esm1, plus listed versions 1.2.10-61.2.10-6build1 |
1.2.10-6ubuntu0.1~esm1 |
libspf2Ubuntu:Pro:18.04:LTS |
before 1.2.10-7ubuntu0.18.04.1~esm1, plus listed versions 1.2.10-7build2 |
1.2.10-7ubuntu0.18.04.1~esm1 |
libspf2Ubuntu:20.04:LTS |
before 1.2.10-7+deb9u2build0.20.04.1, plus listed versions 1.2.10-7build31.2.10-7build4 |
1.2.10-7+deb9u2build0.20.04.1 |
libspf2Ubuntu:Pro:16.04:LTS From an advisory covering 3 CVEs |
before 1.2.10-6ubuntu0.1~esm1, plus listed versions 1.2.10-61.2.10-6build1 |
1.2.10-6ubuntu0.1~esm1 |
libspf2Ubuntu:Pro:18.04:LTS From an advisory covering 3 CVEs |
before 1.2.10-7ubuntu0.18.04.1~esm1, plus listed versions 1.2.10-7build2 |
1.2.10-7ubuntu0.18.04.1~esm1 |
libspf2Ubuntu:20.04:LTS From an advisory covering 3 CVEs |
before 1.2.10-7+deb9u2build0.20.04.1, plus listed versions 1.2.10-7build31.2.10-7build4 |
1.2.10-7+deb9u2build0.20.04.1 |
libspf2SUSE:Package Hub 15 SP1 |
before 1.2.10-bp153.5.1 | 1.2.10-bp153.5.1 |
libspf2SUSE:Package Hub 15 SP2 |
before 1.2.10-bp153.5.1 | 1.2.10-bp153.5.1 |
libspf2SUSE:Package Hub 15 SP3 |
before 1.2.10-bp153.5.1 | 1.2.10-bp153.5.1 |
libspf2openSUSE:Leap 15.2 |
before 1.2.10-bp153.5.1 | 1.2.10-bp153.5.1 |
libspf2openSUSE:Leap 15.3 |
before 1.2.10-bp153.5.1 | 1.2.10-bp153.5.1 |
libspf2openSUSE:Tumbleweed |
before 0.01-5.3 | 0.01-5.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-20314 is a critical vulnerability (CVSS 9.8) in Exim Libspf2, published August 11, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.83%, the 86th percentile. Fixed in libspf2 1.2.10-r5.
References
bugzilla.redhat.com/show_bug.cgi?id=1993070
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CMSFT2NJDZ7PATRZSQPAOGSE7JD6ELOB
security.gentoo.org/glsa/202401-22
nvd.nist.gov/vuln/detail/CVE-2021-20314
Show 20 moreShow less
github.com/advisories/GHSA-7mf9-xf4j-h63m
security.alpinelinux.org/vuln/CVE-2021-20314
security-tracker.debian.org/tracker/CVE-2021-20314
advisories.mageia.org/MGASA-2021-0414.html
bugs.mageia.org/show_bug.cgi?id=29361
openwall.com/lists/oss-security/2021/08/11/6
ubuntu.com/security/CVE-2021-20314
cve.org/CVERecord?id=CVE-2021-20314
lists.opensuse.org/archives/list/[email protected]/thread/3DLLSVZFKUI7FKS5LSGOHVGEIIGA7GFO
bugzilla.suse.com/1189104
suse.com/security/cve/CVE-2021-20314