CVE-2021-33586
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to...
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
- Record
CVE-2021-33586- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
CVE List No score
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
- Record
CVE-2021-33586- Updated
- 2026-11-02
EUVDEUVD-2021-20272 No score
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
- Record
EUVD-2021-20272- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mjhp-8mjg-4p7m
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to...
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
- Record
GHSA-mjhp-8mjg-4p7m- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-33586
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
- Record
ALPINE-CVE-2021-33586- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSV
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
- Record
CVE-2021-33586- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-33586
InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.
- Record
DEBIAN-CVE-2021-33586- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
inspircdAlpine:v3.20 |
3.8.0 up to 3.10.0-r0 | 3.10.0-r0 |
inspircdAlpine:v3.21 |
3.8.0 up to 3.10.0-r0 | 3.10.0-r0 |
inspircdAlpine:v3.22 |
3.8.0 up to 3.10.0-r0 | 3.10.0-r0 |
inspircdAlpine:v3.23 |
3.8.0 up to 3.10.0-r0 | 3.10.0-r0 |
inspircdAlpine:v3.24 |
3.8.0 up to 3.10.0-r0 | 3.10.0-r0 |
inspircdDebian:12 |
before 3.8.1-2 | 3.8.1-2 |
inspircdDebian:13 |
before 3.8.1-2 | 3.8.1-2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-33586 is a medium vulnerability (CVSS 4.3) in Inspircd, published May 27, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in inspircd 3.10.0-r0.
References
docs.inspircd.org/security/2021-01
github.com/inspircd/inspircd/commit/4350a11c663b0d75f8119743bffb7736d87abd4d
security.gentoo.org/glsa/202107-22
nvd.nist.gov/vuln/detail/CVE-2021-33586
security.alpinelinux.org/vuln/CVE-2021-33586
security-tracker.debian.org/tracker/CVE-2021-33586