CVE-2021-31819
Remote Code Execution in Halibut
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
- Record
CVE-2021-31819- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-502
- Updated
- 2026-11-02
CVE ListNo score
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
- Record
CVE-2021-31819- Updated
- 2026-11-02
EUVDEUVD-2021-2073No score
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
- Record
EUVD-2021-2073- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hpf7-4c2g-9chf
Remote Code Execution in Halibut
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
- Record
GHSA-hpf7-4c2g-9chf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
OSV
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
- Record
CVE-2021-31819- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-hpf7-4c2g-9chf
Remote Code Execution in Halibut
In Halibut versions prior to 4.4.7 there is a deserialisation vulnerability that could allow remote code execution on systems that already trust each other based on certificate verification.
- Record
GHSA-hpf7-4c2g-9chf- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-502
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
HalibutNuGet | before 4.4.7 | 4.4.7 |
HalibutNuGet | before 4.4.7, plus listed versions 1.0.1.101.0.1.111.0.1.121.0.1.131.0.1.14 Show 45 moreShow less1.0.1.151.0.1.161.0.1.171.0.1.181.0.1.31.0.1.41.0.1.71.0.1.81.0.1.91.0.2.191.0.2.201.0.2.211.0.2.221.0.2.231.0.2.241.0.2.251.0.2.261.0.2.271.0.2.281.0.2.291.0.2.301.0.2.311.0.2.321.0.2.331.0.2.341.0.2.351.0.2.361.0.2.371.0.2.381.0.2.391.0.2.402.0.1.412.0.1.422.0.1.432.0.1.442.0.1.452.0.1.462.0.1.472.0.2.482.1.0.492.1.0.522.2.0.532.2.0.542.2.0.552.2.2 | 4.4.7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-31819 is a critical vulnerability (CVSS 9.8) in Octopus Halibut, published September 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.35%, the 83rd percentile. Fixed in Halibut 4.4.7.
References
advisories.octopus.com/adv/2021-08---Remote-Code-Execution-via-Deserialisation-in-the-Halibut-Protocol-%28CVE-2021-31819%29.2250309681.html
nvd.nist.gov/vuln/detail/CVE-2021-31819
github.com/advisories/GHSA-hpf7-4c2g-9chf
Left out here: 71 versions. The JSON record has them.