CVE-2021-38380
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s...
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- Record
CVE-2021-38380- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- Record
CVE-2021-38380- Updated
- 2026-11-02
EUVDEUVD-2021-24833 No score
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- Record
EUVD-2021-24833- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3vvx-rwp5-c7c5 No score
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s...
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- Record
GHSA-3vvx-rwp5-c7c5- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-38380
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- Record
ALPINE-CVE-2021-38380- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVDEBIAN-CVE-2021-38380
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- Record
DEBIAN-CVE-2021-38380- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-38380
Live555 through 1.08 mishandles huge requests for the same MP3 stream, leading to recursion and s stack-based buffer over-read. An attacker can leverage this to launch a DoS attack.
- Record
UBUNTU-CVE-2021-38380- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11023-1 No score
libBasicUsageEnvironment1-2021.08.23-1.2 on GA media
These are all security issues fixed in the libBasicUsageEnvironment1-2021.08.23-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11023-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
live-mediaAlpine:v3.16 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.17 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.18 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.19 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.20 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.21 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.22 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.23 |
before 2022.02.07-r0 | 2022.02.07-r0 |
live-mediaAlpine:v3.24 |
before 2022.02.07-r0 | 2022.02.07-r0 |
liblivemediaDebian:14 |
before 2026.09.23-dfsg-1, plus listed versions 2004.11.11a-12005.04.01-12005.06.16-12005.07.21-12005.10.05-1 Show 45 moreShow less2006.03.17-12006.03.17-22007.02.20-12007.02.20-22008.07.25-12008.07.25-22009.11.27-12010.02.10-12010.04.09-12010.11.17-12011.03.14-12011.05.25-12011.06.16-12011.07.08-12011.07.21-12011.08.22-12011.09.02-12011.12.23-12012.02.04-12012.02.29-12012.02.29-22012.04.04-12012.04.21-12012.05.03-12012.05.03-1~bpo60+12012.05.17-12012.05.17-1+wheezy12012.05.17-1~bpo60+12012.08.31-12012.10.24-12012.11.16-12012.11.30-12013.01.05-12013.01.05-22013.01.05-32013.01.15-12013.04.30-12013.10.25-12014.01.13-12015.12.22-12016.01.12-12016.01.16-12016.01.20-12016.01.29-12016.01.29-2 |
2026.09.23-dfsg-1 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
liblivemediaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2014.01.13-12016.01.29-22016.02.09-12016.02.09-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2017.07.18-12017.09.12-1ubuntu12017.10.28-22018.01.29-12018.02.18-12018.02.18-1ubuntu0.1~esm1 |
None known |
liblivemediaUbuntu:20.04:LTS |
All versions, plus listed versions 2018.11.26-1.12020.01.19-12020.01.19-1build1 |
None known |
liblivemediaUbuntu:26.10 |
All versions, plus listed versions 2026.09.23-dfsg-12026.09.23-dfsg-32026.09.23-dfsg-4 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-38380 is a high vulnerability (CVSS 7.5) in Live555, published August 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.53%, the 74th percentile. Fixed in live-media 2022.02.07-r0.
References
lists.live555.com/pipermail/live-devel/2021-August/021954.html
live555.com/liveMedia/public/changelog.txt
nvd.nist.gov/vuln/detail/CVE-2021-38380
github.com/advisories/GHSA-3vvx-rwp5-c7c5
security.alpinelinux.org/vuln/CVE-2021-38380
security-tracker.debian.org/tracker/CVE-2021-38380
Show 13 moreShow less
ubuntu.com/security/CVE-2021-38380
cve.org/CVERecord?id=CVE-2021-38380
suse.com/security/cve/CVE-2018-4013
Left out here: 52 versions. The JSON record has them.