Every CVE Search/ Get API key

CVE-2021-28041

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common...

7.1 HighFix available

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

3.51%Up 2.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.1

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
CVE-2021-28041
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:N/AC:H/Au:S/C:P/I:P/A:P
Weakness
CWE-415
Updated
2026-11-02
CVE List No score

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
CVE-2021-28041
Updated
2026-11-02
EUVDEUVD-2021-14748 No score

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
EUVD-2021-14748
Updated
2026-11-02
GitHub AdvisoriesGHSA-gp5m-rxrx-pfrj 7.1

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common...

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
GHSA-gp5m-rxrx-pfrj
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-415
Updated
2026-11-02
OSVALPINE-CVE-2021-28041 7.1

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
ALPINE-CVE-2021-28041
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVBELL-CVE-2021-28041 7.1

CVE-2021-28041 does not affect BellSoft software

Record
BELL-CVE-2021-28041
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 11 moreShow less
OSV 7.1

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
CVE-2021-28041
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-28041 7.1

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
DEBIAN-CVE-2021-28041
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVJLSEC-2026-64 7.1

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
JLSEC-2026-64
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
4.6 MediumAV:N/AC:H/Au:S/C:P/I:P/A:P
Updated
2026-11-02
OSVOESA-2021-1466 7.1

openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.(CVE-2021-28041)

Record
OESA-2021-1466
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVOESA-2022-2083 7.1

openssh security update

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.

Security Fix(es):

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.(CVE-2021-28041)

Record
OESA-2022-2083
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-28041 7.1

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Record
UBUNTU-CVE-2021-28041
CVSS 3.1
7.1 HighCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2021-0261 No score

Updated openssh packages fix a security vulnerability

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host (CVE-2021-28041).

Record
MGASA-2021-0261
Updated
2026-11-02
OSVopenSUSE-SU-2021:4153-1 No score

Security update for openssh

This update for openssh fixes the following issues:

  • CVE-2021-28041: Fixed double free in ssh-agent (bsc#1183137).
Record
openSUSE-SU-2021:4153-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13842-1 No score

openssh-9.6p1-3.1 on GA media

These are all security issues fixed in the openssh-9.6p1-3.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13842-1
Updated
2026-11-02
OSVSUSE-SU-2021:4153-1 No score

Security update for openssh

This update for openssh fixes the following issues:

  • CVE-2021-28041: Fixed double free in ssh-agent (bsc#1183137).
Record
SUSE-SU-2021:4153-1
Updated
2026-11-02
OSVUSN-4762-1 No score

openssh vulnerability

It was discovered that the OpenSSH ssh-agent incorrectly handled memory. A remote attacker able to connect to the agent could use this issue to cause it to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-4762-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openssh
Alpine:v3.12
 8.2 up to 8.3_p1-r2
8.3_p1-r2
openssh
Alpine:v3.13
 8.2 up to 8.4_p1-r1
8.4_p1-r1
openssh
Alpine:v3.14
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.15
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.16
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.17
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.18
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.19
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.20
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.21
 8.2 up to 8.5_p1-r0
8.5_p1-r0
Show 19 moreShow less
Affected packages
PackageAffectedFixed
openssh
Alpine:v3.22
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.23
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Alpine:v3.24
 8.2 up to 8.5_p1-r0
8.5_p1-r0
openssh
Debian:12
 before 1:8.4p1-5
1:8.4p1-5
openssh
Debian:13
 before 1:8.4p1-5
1:8.4p1-5
openssh
Debian:14
 before 1:8.4p1-5
1:8.4p1-5
OpenSSH_jll
Julia
 8.9.0+0 up to 9.1.0+0
9.1.0+0
openssh
Mageia:8
 before 8.4p1-2.1.mga8
8.4p1-2.1.mga8
openssh
openEuler:20.03-LTS-SP1
 before 8.2p1-15.oe1
8.2p1-15.oe1
openssh
openEuler:20.03-LTS-SP2
 before 8.2p1-15.oe1
8.2p1-15.oe1
openssh
openEuler:20.03-LTS-SP3
 before 8.2p1-16.oe1
8.2p1-16.oe1
openssh
SUSE:Linux Enterprise Module for Basesystem 15 SP3
 before 8.4p1-3.9.1
8.4p1-3.9.1
openssh-askpass-gnome
SUSE:Linux Enterprise Module for Desktop Applications 15 SP3
 before 8.4p1-3.9.1
8.4p1-3.9.1
openssh
SUSE:Linux Enterprise Module for Server Applications 15 SP3
 before 8.4p1-3.9.1
8.4p1-3.9.1
openssh
SUSE:Linux Enterprise Micro 5.1
 before 8.4p1-3.9.1
8.4p1-3.9.1
openssh
Ubuntu:20.04:LTS
 before 1:8.2p1-4ubuntu0.2, plus listed versions
1:8.0p1-6build11:8.1p1-11:8.1p1-51:8.2p1-41:8.2p1-4ubuntu0.1
1:8.2p1-4ubuntu0.2
openssh
openSUSE:Leap 15.3
 before 8.4p1-3.9.1
8.4p1-3.9.1
openssh-askpass-gnome
openSUSE:Leap 15.3
 before 8.4p1-3.9.1
8.4p1-3.9.1
openssh
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 9.6p1-3.1
9.6p1-3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-28041 is a high vulnerability (CVSS 7.1) in Openbsd Openssh, published March 5, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.51%, the 89th percentile. Fixed in openssh 8.3_p1-r2.

References

Show 24 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open