CVE-2021-23437
Regular Expression Denial of Service (ReDoS)
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Regular Expression Denial of Service (ReDoS)
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
CVE-2021-23437- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
EUVDEUVD-2021-0170
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
EUVD-2021-0170- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-98vv-pw6r-q6q4
Uncontrolled Resource Consumption in pillow
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
GHSA-98vv-pw6r-q6q4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125, CWE-400
- Updated
- 2026-11-02
NVD
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
CVE-2021-23437- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-23437
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
ALPINE-CVE-2021-23437- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
CVE-2021-23437- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 17 moreShow less
OSVDEBIAN-CVE-2021-23437
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
DEBIAN-CVE-2021-23437- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-98vv-pw6r-q6q4
Uncontrolled Resource Consumption in pillow
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
GHSA-98vv-pw6r-q6q4- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-125, CWE-400
- Updated
- 2026-11-02
OSVOESA-2021-1383
python-pillow security update
Pillow is the friendly PIL fork by Alex Clark and Contributors. PIL is the Python Imaging Library by Fredrik Lundh and Contributors. As of 2019, Pillow development is supported by Tidelift.
Security Fix(es):
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.(CVE-2021-23437)
- Record
OESA-2021-1383- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-23437
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
UBUNTU-CVE-2021-23437- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-pillow-2021-23437 No score
Regular Expression Denial of Service (ReDoS)
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
BIT-pillow-2021-23437- Updated
- 2026-11-02
OSVMGASA-2021-0448 No score
Updated python-pillow packages fix security vulnerability
Updated python-pillow packages fix security vulnerability:
The package pillow 5.2.0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function (CVE-2021-23437).
- Record
MGASA-2021-0448- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11209-1 No score
python36-Pillow-8.3.2-1.2 on GA media
These are all security issues fixed in the python36-Pillow-8.3.2-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11209-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13827-1 No score
python310-Pillow-10.3.0-1.1 on GA media
These are all security issues fixed in the python310-Pillow-10.3.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13827-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11261-1 No score
python313-Pillow-12.3.0-1.1 on GA media
These are all security issues fixed in the python313-Pillow-12.3.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11261-1- Updated
- 2026-11-02
OSVPYSEC-2021-317 No score
The package pillow from 0 and before 8.3.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.
- Record
PYSEC-2021-317- Updated
- 2026-11-02
OSVROOT-APP-PYPI-CVE-2021-23437 No score
CVE-2021-23437 in pillow - Patched by Root
Root has patched CVE-2021-23437 in the pillow package for Root:PyPI. Multiple fixed versions available.
- Record
ROOT-APP-PYPI-CVE-2021-23437- Updated
- 2026-11-05
OSVSUSE-SU-2021:3234-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues:
- CVE-2021-23437: Fixed regular expression denial of service (ReDoS) via the getrgb function (bsc#1190229).
- Record
SUSE-SU-2021:3234-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3235-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues:
- CVE-2021-23437: Fixed regular expression denial of service (ReDoS) via the getrgb function (bsc#1190229).
- Record
SUSE-SU-2021:3235-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1673-1 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues:
- Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
- Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
- Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)
- Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
- Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
- Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
- Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
- Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
- OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)
- Record
SUSE-SU-2024:1673-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:1673-2 No score
Security update for python-Pillow
This update for python-Pillow fixes the following issues:
- Fixed ImagePath.Path array handling (bsc#1194552, CVE-2022-22815, bsc#1194551, CVE-2022-22816)
- Use snprintf instead of sprintf (bsc#1188574, CVE-2021-34552)
- Fix Memory DOS in Icns, Ico and Blp Image Plugins. (bsc#1183110, CVE-2021-27921, bsc#1183108, CVE-2021-27922, bsc#1183107, CVE-2021-27923)
- Fix OOB read in SgiRleDecode.c (bsc#1183102, CVE-2021-25293)
- Use more specific regex chars to prevent ReDoS (bsc#1183101, CVE-2021-25292)
- Fix negative size read in TiffDecode.c (bsc#1183105, CVE-2021-25290)
- Raise ValueError if color specifier is too long (bsc#1190229, CVE-2021-23437)
- Incorrect error code checking in TiffDecode.c (bsc#1183103, CVE-2021-25289)
- OOB Write in TiffDecode.c (bsc#1180833, CVE-2020-35654)
- Record
SUSE-SU-2024:1673-2- Updated
- 2026-11-02
OSVUSN-5227-1 No score
pillow vulnerabilities
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.04. (CVE-2021-34552)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22815)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. (CVE-2022-22816)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22817)
- Record
USN-5227-1- Updated
- 2026-11-02
OSVUSN-5227-2 No score
pillow vulnerabilities
USN-5227-1 fixed several vulnerabilities in Pillow. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to hang, resulting in a denial of service. (CVE-2021-23437)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. This issue ony affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 21.04. (CVE-2021-34552)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22815)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service. (CVE-2022-22816)
It was discovered that Pillow incorrectly handled certain image files. If a user or automated system were tricked into opening a specially-crafted file, a remote attacker could cause Pillow to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2022-22817)
- Record
USN-5227-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pillowPyPI |
5.2.0 up to 8.3.2 | 8.3.2 |
py-pillowAlpine:v3.11 |
before 6.2.1-r1 | 6.2.1-r1 |
py3-pillowAlpine:v3.12 |
before 7.1.2-r2 | 7.1.2-r2 |
py3-pillowAlpine:v3.13 |
before 7.2.0-r2 | 7.2.0-r2 |
py3-pillowAlpine:v3.14 |
before 8.2.0-r1 | 8.2.0-r1 |
py3-pillowAlpine:v3.15 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.16 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.17 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.18 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.19 |
before 8.4.0-r0 | 8.4.0-r0 |
Show 37 moreShow less
| Package | Affected | Fixed |
|---|---|---|
py3-pillowAlpine:v3.20 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.21 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.22 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.23 |
before 8.4.0-r0 | 8.4.0-r0 |
py3-pillowAlpine:v3.24 |
before 8.4.0-r0 | 8.4.0-r0 |
pillowBitnami |
5.2.0 up to 8.3.2 | 8.3.2 |
pillowDebian:12 |
before 8.3.2-1 | 8.3.2-1 |
pillowDebian:13 |
before 8.3.2-1 | 8.3.2-1 |
pillowDebian:14 |
before 8.3.2-1 | 8.3.2-1 |
pillowDebian:10 From an advisory covering 3 CVEs |
before 5.4.1-2+deb10u5, plus listed versions 5.4.1-25.4.1-2+deb10u15.4.1-2+deb10u25.4.1-2+deb10u35.4.1-2+deb10u4 |
5.4.1-2+deb10u5 |
pillowDebian:11 From an advisory covering 3 CVEs |
before 8.1.2+dfsg-0.3+deb11u3, plus listed versions 8.1.2+dfsg-0.38.1.2+dfsg-0.3+deb11u18.1.2+dfsg-0.3+deb11u2 |
8.1.2+dfsg-0.3+deb11u3 |
pillowPyPI |
5.2.0 up to 8.3.2, plus listed versions 5.3.05.4.05.4.0.dev05.4.16.0.0 Show 17 moreShow less6.1.06.2.06.2.16.2.27.0.07.1.07.1.17.1.27.2.08.0.08.0.18.1.08.1.18.1.28.2.08.3.08.3.1 |
8.3.2 |
python-pillowMageia:8 |
before 8.1.2-1.1.mga8 | 8.1.2-1.1.mga8 |
python-pillowopenEuler:20.03-LTS-SP1 |
before 8.1.1-7.oe1 | 8.1.1-7.oe1 |
python-pillowopenEuler:20.03-LTS-SP2 |
before 8.1.1-7.oe1 | 8.1.1-7.oe1 |
pillowPyPI |
before 8.3.2, plus listed versions 1.01.11.21.31.4 Show 45 moreShow less1.51.61.7.01.7.11.7.21.7.31.7.41.7.51.7.61.7.71.7.82.0.02.1.02.2.02.2.12.2.22.3.02.3.12.3.22.4.02.5.02.5.12.5.22.5.32.6.02.6.12.6.22.7.02.8.02.8.12.8.22.9.03.0.03.1.03.1.0.rc13.1.0rc13.1.13.1.23.2.03.3.03.3.13.3.23.3.33.4.03.4.1 |
8.3.2 |
pillowRoot:PyPI |
before 8.0.1+aikido.1 | 8.0.1+aikido.18.1.2+aikido.18.0.1+aikido.28.2.0+aikido.17.0.0+aikido.27.0.0+aikido.3 |
python-PillowSUSE:HPE Helion OpenStack 8 |
before 4.2.1-3.20.2 | 4.2.1-3.20.2 |
python-PillowSUSE:OpenStack Cloud 8 |
before 4.2.1-3.20.2 | 4.2.1-3.20.2 |
python-PillowSUSE:OpenStack Cloud Crowbar 8 |
before 4.2.1-3.20.2 | 4.2.1-3.20.2 |
python-PillowSUSE:OpenStack Cloud 9 |
before 5.2.0-3.14.1 | 5.2.0-3.14.1 |
python-PillowSUSE:OpenStack Cloud Crowbar 9 |
before 5.2.0-3.14.1 | 5.2.0-3.14.1 |
python-PillowopenSUSE:Leap 15.5 From an advisory covering 12 CVEs |
before 7.2.0-150300.3.15.1 | 7.2.0-150300.3.15.1 |
python-PillowSUSE:Linux Enterprise Module for Package Hub 15 SP6 From an advisory covering 12 CVEs |
before 7.2.0-150300.3.15.1 | 7.2.0-150300.3.15.1 |
pillowUbuntu:Pro:14.04:LTS |
before 2.3.0-1ubuntu3.4+esm3, plus listed versions 2.2.1-1ubuntu22.2.1-2ubuntu12.2.1-3ubuntu22.2.1-3ubuntu32.2.1-3ubuntu4 Show 9 moreShow less2.2.1-3ubuntu62.3.0-1ubuntu12.3.0-1ubuntu22.3.0-1ubuntu32.3.0-1ubuntu3.22.3.0-1ubuntu3.32.3.0-1ubuntu3.42.3.0-1ubuntu3.4+esm12.3.0-1ubuntu3.4+esm2 |
2.3.0-1ubuntu3.4+esm3 |
pillowUbuntu:Pro:16.04:LTS |
before 3.1.2-0ubuntu1.6+esm1, plus listed versions 2.9.0-13.0.0-13.0.0-1build13.1.0-13.1.1-1 Show 6 moreShow less3.1.2-0ubuntu13.1.2-0ubuntu1.13.1.2-0ubuntu1.33.1.2-0ubuntu1.43.1.2-0ubuntu1.53.1.2-0ubuntu1.6 |
3.1.2-0ubuntu1.6+esm1 |
pillowUbuntu:18.04:LTS |
before 5.1.0-1ubuntu0.7, plus listed versions 4.1.1-3build24.3.0-2ubuntu15.0.0-15.1.0-15.1.0-1ubuntu0.2 Show 4 moreShow less5.1.0-1ubuntu0.35.1.0-1ubuntu0.45.1.0-1ubuntu0.55.1.0-1ubuntu0.6 |
5.1.0-1ubuntu0.7 |
pillowUbuntu:20.04:LTS |
before 7.0.0-4ubuntu0.5, plus listed versions 6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1 Show 4 moreShow less7.0.0-4ubuntu0.17.0.0-4ubuntu0.27.0.0-4ubuntu0.37.0.0-4ubuntu0.4 |
7.0.0-4ubuntu0.5 |
pillow-python2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 6.2.1-3~build16.2.1-36.2.1-3ubuntu0.1~esm16.2.1-3ubuntu0.1~esm2 |
None known |
pillowUbuntu:22.04:LTS |
before 9.0.0-1, plus listed versions 8.1.2+dfsg-0.3 |
9.0.0-1 |
pillowUbuntu:18.04:LTS From an advisory covering 5 CVEs |
before 5.1.0-1ubuntu0.7, plus listed versions 4.1.1-3build24.3.0-2ubuntu15.0.0-15.1.0-15.1.0-1ubuntu0.2 Show 4 moreShow less5.1.0-1ubuntu0.35.1.0-1ubuntu0.45.1.0-1ubuntu0.55.1.0-1ubuntu0.6 |
5.1.0-1ubuntu0.7 |
pillowUbuntu:20.04:LTS From an advisory covering 5 CVEs |
before 7.0.0-4ubuntu0.5, plus listed versions 6.1.0-16.1.0-1build16.2.1-27.0.0-47.0.0-4build1 Show 4 moreShow less7.0.0-4ubuntu0.17.0.0-4ubuntu0.27.0.0-4ubuntu0.37.0.0-4ubuntu0.4 |
7.0.0-4ubuntu0.5 |
pillowUbuntu:Pro:14.04:LTS From an advisory covering 5 CVEs |
before 2.3.0-1ubuntu3.4+esm3, plus listed versions 2.2.1-1ubuntu22.2.1-2ubuntu12.2.1-3ubuntu22.2.1-3ubuntu32.2.1-3ubuntu4 Show 9 moreShow less2.2.1-3ubuntu62.3.0-1ubuntu12.3.0-1ubuntu22.3.0-1ubuntu32.3.0-1ubuntu3.22.3.0-1ubuntu3.32.3.0-1ubuntu3.42.3.0-1ubuntu3.4+esm12.3.0-1ubuntu3.4+esm2 |
2.3.0-1ubuntu3.4+esm3 |
pillowUbuntu:Pro:16.04:LTS From an advisory covering 5 CVEs |
before 3.1.2-0ubuntu1.6+esm1, plus listed versions 2.9.0-13.0.0-13.0.0-1build13.1.0-13.1.1-1 Show 6 moreShow less3.1.2-0ubuntu13.1.2-0ubuntu1.13.1.2-0ubuntu1.33.1.2-0ubuntu1.43.1.2-0ubuntu1.53.1.2-0ubuntu1.6 |
3.1.2-0ubuntu1.6+esm1 |
python-PillowopenSUSE:Tumbleweed From an advisory covering 17 CVEs |
before 8.3.2-1.2 | 8.3.2-1.2 |
python-PillowopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 10.3.0-1.1 | 10.3.0-1.1 |
python-PillowopenSUSE:Tumbleweed From an advisory covering 24 CVEs |
before 12.3.0-1.1 | 12.3.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected | OSV | |
| affected, facts | OSV | |
| affected | OSV | |
| affected | OSV | |
| aliases, products, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-23437 is a high vulnerability (CVSS 7.5) in Python Pillow, published September 3, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.24%, the 88th percentile. Fixed in pillow 8.3.2.
References
snyk.io/vuln/SNYK-PYTHON-PILLOW-1319443
pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html
github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VKRCL7KKAKOXCVD7M6WC5OKFGL4L3SJT
security.gentoo.org/glsa/202211-10
Show 64 moreShow less
lists.debian.org/debian-lts-announce/2024/03/msg00021.html
nvd.nist.gov/vuln/detail/CVE-2021-23437
security.alpinelinux.org/vuln/CVE-2021-23437
security-tracker.debian.org/tracker/CVE-2021-23437
advisories.mageia.org/MGASA-2021-0448.html
bugs.mageia.org/show_bug.cgi?id=29481
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1383
suse.com/support/update/announcement/2021/suse-su-20213234-1
bugzilla.suse.com/1190229
ubuntu.com/security/CVE-2021-23437
cve.org/CVERecord?id=CVE-2021-23437
Left out here: 32 versions. The JSON record has them.