CVE-2021-36217

Avahi 0.8 allows a local denial of service (NULL pointer dereference and daemon crash) against...

5.5 MediumFix availableRejected

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3502. Reason: This candidate is a duplicate of CVE-2021-3502. Notes: All CVE users should reference CVE-2021-3502 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

What each source reports

OSV Score usedOESA-2021-1273 5.5

avahi security update

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. This enables you to plug your laptop or computer into a network and instantly be able to view other people who you can chat with, find printers to print to or find files being shared.

Security Fix(es):

Avahi 0.8 allows a local denial of service (NULL pointer dereference and daemon crash) against avahi-daemon via the D-Bus interface or a "ping .local" command.(CVE-2021-36217)

Record: OESA-2021-1273
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-36217
Updated: 2026-11-02

EUVDEUVD-2021-22837 No score

Record: EUVD-2021-22837
Updated: 2026-11-03

GitHub AdvisoriesGHSA-r9vw-9gvx-7g72 No score

Avahi 0.8 allows a local denial of service (NULL pointer dereference and daemon crash) against...

Avahi 0.8 allows a local denial of service (NULL pointer dereference and daemon crash) against avahi-daemon via the D-Bus interface or a "ping .local" command.

Record: GHSA-r9vw-9gvx-7g72
Weakness: CWE-476
Updated: 2026-11-02

NVD No score

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3502. Reason: This candidate is a duplicate of CVE-2021-3502. Notes: All CVE users should reference CVE-2021-3502 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage

Record: CVE-2021-36217
Updated: 2026-11-02

OSVALPINE-CVE-2021-36217 No score

Record: ALPINE-CVE-2021-36217
Updated: 2026-11-02

OSV No score

Record: CVE-2021-36217
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`avahi` Alpine:v3.12	before 0.8-r2	0.8-r2
`avahi` Alpine:v3.13	before 0.8-r4	0.8-r4
`avahi` Alpine:v3.14	before 0.8-r5	0.8-r5
`avahi` Alpine:v3.15	before 0.8-r5	0.8-r5
`avahi` Alpine:v3.16	before 0.8-r5	0.8-r5
`avahi` Alpine:v3.17	before 0.8-r5	0.8-r5
`avahi` openEuler:20.03-LTS-SP1	before 0.8-5.oe1	0.8-5.oe1
`avahi` openEuler:20.03-LTS-SP2	before 0.8-5.oe1	0.8-5.oe1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-36217 has been rejected by its source and should not be treated as a live vulnerability, published July 7, 2021. Fixed in avahi 0.8-r2.