CVE-2021-36373
Apache Ant TAR archive denial of service vulnerability
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
CVE-2021-36373- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-130
- Updated
- 2026-11-02
CVE List No score
Apache Ant TAR archive denial of service vulnerability
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
CVE-2021-36373- Weakness
- CWE-130
- Updated
- 2026-11-02
EUVDEUVD-2021-1834 No score
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
EUVD-2021-1834- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q5r4-cfpx-h6fh
Improper Handling of Length Parameter Inconsistency in Apache Ant
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
GHSA-q5r4-cfpx-h6fh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-36373
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
ALPINE-CVE-2021-36373- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVAZL-25953
CVE-2021-36373 affecting package javapackages-bootstrap for versions less than 1.5.0-6
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
AZL-25953- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 12 moreShow less
OSVAZL-34808
CVE-2021-36373 affecting package javapackages-bootstrap for versions less than 1.14.0-2
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
AZL-34808- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBELL-CVE-2021-36373
CVE-2021-36373 does not affect BellSoft software
- Record
BELL-CVE-2021-36373- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
CVE-2021-36373- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-36373
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
DEBIAN-CVE-2021-36373- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-q5r4-cfpx-h6fh
Improper Handling of Length Parameter Inconsistency in Apache Ant
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
GHSA-q5r4-cfpx-h6fh- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-130
- Updated
- 2026-11-02
OSVOESA-2021-1277
ant security update
Ant is a Java based build tool. In theory it is kind of like "make" without makes wrinkles and with the full portability of pure java code.
Security Fix(es):
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.(CVE-2021-36373)
When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.(CVE-2021-36374)
- Record
OESA-2021-1277- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-36373
When reading a specially crafted TAR archive an Apache Ant build can be made to allocate large amounts of memory that finally leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Apache Ant prior to 1.9.16 and 1.10.11 were affected.
- Record
UBUNTU-CVE-2021-36373- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1782225575 No score
ant: Fix of 2 CVEs
- CVE-2021-36373: resource exhaustion (OOM) when reading a crafted TAR archive's PAX extended header
- CVE-2021-36374: resource exhaustion (OOM) when reading a crafted ZIP archive
- Drop the GetTest (network) and ImageIOTest (JDK ImageIO) unit tests
- Record
CLSA-2026-1782225575- Updated
- 2026-11-02
OSVCLSA-2026-1789710127 No score
TuxCare security update for org.apache.ant:ant (2 CVEs)
TuxCare rebuilt org.apache.ant:ant to address 2 CVEs. Fixed in 1.9.4-tuxcare.2.
- Record
CLSA-2026-1789710127- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11688-1 No score
ant-1.10.12-1.1 on GA media
These are all security issues fixed in the ant-1.10.12-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11688-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1417-1 No score
Security update for ant
This update for ant fixes the following issues:
- CVE-2021-36373: Fixed an excessive memory allocation when reading a specially crafted TAR archive (bsc#1188468).
- CVE-2021-36374: Fixed an excessive memory allocation when reading a specially crafted ZIP archive (bsc#1188469).
- Record
SUSE-SU-2022:1417-1- Updated
- 2026-11-02
OSVSUSE-SU-2022:1418-1 No score
Security update for ant
This update for ant fixes the following issues:
- CVE-2021-36373: Fixed an excessive memory allocation when reading a specially crafted TAR archive (bsc#1188468).
- CVE-2021-36374: Fixed an excessive memory allocation when reading a specially crafted ZIP archive (bsc#1188469).
- Record
SUSE-SU-2022:1418-1- Updated
- 2026-11-02
Affected products
- apache ant
- apache software foundation ant
- oracle agile product lifecycle management
- oracle banking trade finance
- oracle banking treasury management
- oracle communications cloud native core automated test suite
- oracle communications cloud native core binding support function
- oracle communications order and service management
- oracle communications unified inventory management
- oracle enterprise repository
- oracle financial services analytical applications infrastructure
- oracle insurance policy administration
Show 21 moreShow less
- oracle primavera gateway
- oracle primavera unifier
- oracle real-time decision server
- oracle retail advanced inventory planning
- oracle retail back office
- oracle retail bulk data integration
- oracle retail central office
- oracle retail eftlink
- oracle retail extract transform and load
- oracle retail financial integration
- oracle retail integration bus
- oracle retail invoice matching
- oracle retail merchandising system
- oracle retail point-of-service
- oracle retail predictive application server
- oracle retail service backbone
- oracle retail store inventory management
- oracle retail xstore point of service
- oracle timesten in-memory database
- oracle utilities framework
- oracle utilities testing accelerator
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.ant:antMaven |
before 1.9.16 | 1.9.16 |
org.apache.ant:antMaven |
1.10.0 up to 1.10.11 | 1.10.11 |
apache-antAlpine:v3.14 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.15 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.16 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.17 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.18 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.19 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.20 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.21 |
before 1.10.11-r0 | 1.10.11-r0 |
Show 64 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache-antAlpine:v3.22 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.23 |
before 1.10.11-r0 | 1.10.11-r0 |
apache-antAlpine:v3.24 |
before 1.10.11-r0 | 1.10.11-r0 |
javapackages-bootstrapAzure Linux:2 |
before 1.5.0-6 | 1.5.0-6 |
javapackages-bootstrapAzure Linux:3 |
before 1.14.0-2 | 1.14.0-2 |
antTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-antlrTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-apache-bcelTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-apache-bsfTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-apache-oroTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-apache-regexpTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-apache-resolverTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-apache-xalan2TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-commons-loggingTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-commons-netTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-imageioTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-javadocTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-javamailTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-jdependTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-jmfTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-jschTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-junitTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-junit5TuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-libTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-manualTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-swingTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-testutilTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
ant-xzTuxCare:AlmaLinux:9.2 From an advisory covering 2 CVEs |
before 1.10.9-7.el9.tuxcare.els1 | 1.10.9-7.el9.tuxcare.els1 |
org.apache.ant:antTuxCare:Maven From an advisory covering 2 CVEs |
1.9.4 up to 1.9.4-tuxcare.2, plus listed versions 1.9.4-tuxcare.1 |
1.9.4-tuxcare.2 |
antDebian:12 |
before 1.10.11-1 | 1.10.11-1 |
antDebian:13 |
before 1.10.11-1 | 1.10.11-1 |
antDebian:14 |
before 1.10.11-1 | 1.10.11-1 |
org.apache.ant:antMaven |
before 1.9.16, plus listed versions 1.7.01.7.11.8.01.8.11.8.2 Show 18 moreShow less1.8.31.8.41.9.01.9.11.9.101.9.111.9.121.9.131.9.141.9.151.9.21.9.31.9.41.9.51.9.61.9.71.9.81.9.9 |
1.9.16 |
org.apache.ant:antMaven |
1.10.0 up to 1.10.11, plus listed versions 1.10.11.10.101.10.21.10.31.10.4 Show 5 moreShow less1.10.51.10.61.10.71.10.81.10.9 |
1.10.11 |
antopenEuler:20.03-LTS-SP1 From an advisory covering 2 CVEs |
before 1.10.8-4.oe1 | 1.10.8-4.oe1 |
antopenEuler:20.03-LTS-SP2 From an advisory covering 2 CVEs |
before 1.10.8-4.oe1 | 1.10.8-4.oe1 |
antSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 1.9.4-3.9.1 | 1.9.4-3.9.1 |
ant-antlrSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 2 CVEs |
before 1.9.4-3.9.1 | 1.9.4-3.9.1 |
antSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 2 CVEs |
before 1.9.4-3.9.1 | 1.9.4-3.9.1 |
antSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 2 CVEs |
before 1.9.4-3.9.1 | 1.9.4-3.9.1 |
antSUSE:Linux Enterprise Module for Development Tools 15 SP3 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-antlrSUSE:Linux Enterprise Module for Development Tools 15 SP3 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-junitSUSE:Linux Enterprise Module for Development Tools 15 SP3 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
antSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-antlrSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-junitSUSE:Linux Enterprise Real Time 15 SP2 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
antopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-antlropenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-junitopenSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-junit5openSUSE:Leap 15.3 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
antopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-antlropenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-junitopenSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
ant-junit5openSUSE:Leap 15.4 From an advisory covering 2 CVEs |
before 1.10.7-150200.4.6.1 | 1.10.7-150200.4.6.1 |
antUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.9.2-11.9.3-11.9.3-21.9.3-2build11.9.3-2ubuntu0.11.9.3-2ubuntu0.1+esm1 |
None known |
antUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.9.6-1ubuntu11.9.6-1ubuntu1.11.9.6-1ubuntu1.1+esm1 |
None known |
antUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.9.9-41.9.9-51.9.9-61.9.10-11.9.10-2 Show 4 moreShow less1.10.3-11.10.3-1ubuntu0.11.10.5-3~18.041.10.5-3~18.04.1~esm1 |
None known |
antUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.10.6-11.10.7-11.10.7-1ubuntu0.1~esm1 |
None known |
antUbuntu:22.04:LTS |
All versions, plus listed versions 1.10.9-41.10.11-11.10.12-1 |
None known |
antUbuntu:24.04:LTS |
All versions, plus listed versions 1.10.13-21.10.14-1 |
None known |
antUbuntu:25.10 |
All versions, plus listed versions 1.10.15-1 |
None known |
antUbuntu:26.10 |
All versions, plus listed versions 1.10.15-1build11.10.17-11.10.18-1 |
None known |
antUbuntu:26.04:LTS |
All versions, plus listed versions 1.10.15-11.10.15-1build1 |
None known |
antopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.10.12-1.1 | 1.10.12-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36373 is a medium vulnerability (CVSS 5.5) in Apache Ant, published July 14, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.53%, the 85th percentile. Fixed in org.apache.ant:ant 1.9.16.
References
ant.apache.org/security.html
lists.apache.org/thread.html/r54afdab05e01de970649c2d91a993f68a6b00cd73e6e34e16c832d46%40%3Cuser.ant.apache.org%3E
Show 26 moreShow less
oracle.com/security-alerts/cpuoct2021.html
security.netapp.com/advisory/ntap-20210819-0007
nvd.nist.gov/vuln/detail/CVE-2021-36373
github.com/advisories/GHSA-q5r4-cfpx-h6fh
security.alpinelinux.org/vuln/CVE-2021-36373
docs.bell-sw.com/security/cves/CVE-2021-36373
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782225575.html
security-tracker.debian.org/tracker/CVE-2021-36373
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1277
suse.com/support/update/announcement/2022/suse-su-20221417-1
bugzilla.suse.com/1188468
ubuntu.com/security/CVE-2021-36373
openwall.com/lists/oss-security/2021/07/13/5
cve.org/CVERecord?id=CVE-2021-36373