Every CVE Search/ Get API key

CVE-2021-4213

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted...

7.5 HighFix available

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.74%Up 0.8 points since Aug 25, 2022
90%50%10%1%

What each source reports

NVD Score used 7.5

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Record
CVE-2021-4213
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-02
CVE List No score

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Record
CVE-2021-4213
Weakness
CWE-401
Updated
2026-11-02
EUVDEUVD-2021-34071 No score

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Record
EUVD-2021-34071
Updated
2026-11-03
GitHub AdvisoriesGHSA-727r-5fr6-wjfp 7.5

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted...

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Record
GHSA-727r-5fr6-wjfp
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-401
Updated
2026-11-02
OSV 7.5

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Record
CVE-2021-4213
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2021-4213 7.5

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Record
DEBIAN-CVE-2021-4213
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 8 moreShow less
OSVOESA-2024-1208 7.5

jss security update

JSS offers a implementation for java-based applications to use native NSS.

Security Fix(es):

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.(CVE-2021-4213)

Record
OESA-2024-1208
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1220 7.5

jss security update

JSS offers a implementation for java-based applications to use native NSS.

Security Fix(es):

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.(CVE-2021-4213)

Record
OESA-2024-1220
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVOESA-2024-1221 7.5

jss security update

JSS offers a implementation for java-based applications to use native NSS.

Security Fix(es):

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.(CVE-2021-4213)

Record
OESA-2024-1221
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2022:1851 7.5

Red Hat Security Advisory: pki-core:10.6 security and bug fix update

Record
RHSA-2022:1851
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2024:0774 7.5

Red Hat Security Advisory: Red Hat Certificate System 10.4 for RHEL 8 security and bug fix update

Record
RHSA-2024:0774
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRLSA-2022:1851 7.5

Moderate: pki-core:10.6 security and bug fix update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

  • JSS: memory leak in TLS connection leads to OOM (CVE-2021-4213)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.

Record
RLSA-2022:1851
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-4213 7.5

A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service.

Record
UBUNTU-CVE-2021-4213
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVALSA-2022:1851 No score

Moderate: pki-core:10.6 security and bug fix update

The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.

Security Fix(es):

  • JSS: memory leak in TLS connection leads to OOM (CVE-2021-4213)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Record
ALSA-2022:1851
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jss
AlmaLinux:8
 before 4.9.3-1.module_el8.6.0+2764+9fc58d50
4.9.3-1.module_el8.6.0+2764+9fc58d50
jss-javadoc
AlmaLinux:8
 before 4.9.3-1.module_el8.6.0+2764+9fc58d50
4.9.3-1.module_el8.6.0+2764+9fc58d50
ldapjdk
AlmaLinux:8
 before 4.23.0-1.module_el8.6.0+2764+9fc58d50
4.23.0-1.module_el8.6.0+2764+9fc58d50
ldapjdk-javadoc
AlmaLinux:8
 before 4.23.0-1.module_el8.6.0+2764+9fc58d50
4.23.0-1.module_el8.6.0+2764+9fc58d50
pki-acme
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
pki-base
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
pki-base-java
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
pki-ca
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
pki-kra
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
pki-server
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
Show 45 moreShow less
Affected packages
PackageAffectedFixed
pki-symkey
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
pki-tools
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
python3-pki
AlmaLinux:8
 before 10.12.0-2.module_el8.6.0+2764+9fc58d50
10.12.0-2.module_el8.6.0+2764+9fc58d50
tomcatjss
AlmaLinux:8
 before 7.7.1-1.module_el8.6.0+2764+9fc58d50
7.7.1-1.module_el8.6.0+2764+9fc58d50
jss
Debian:12
 before 5.2.0-1
5.2.0-1
jss
Debian:14
 before 5.2.0-1, plus listed versions
4.3.1-44.3.1-54.3.1-64.3.1-74.4.2-1
Show 30 moreShow less
4.4.2-24.4.2-34.4.2-44.4.2-54.4.2-64.4.3-14.4.4-14.5.0-14.5.0~a4-14.5.1-14.5.3-14.5.3-24.6.0-14.6.1-14.6.1-24.6.1-34.6.2-14.6.3-14.7.0-14.7.0~b1-14.7.0~b4-14.7.0~b4-24.7.1-14.7.2-14.7.3-14.8.0-14.8.0-24.9.1-15.0.0-15.1.0-1
5.2.0-1
jss
openEuler:22.03-LTS
 before 4.9.3-1.oe2203
4.9.3-1.oe2203
jss
openEuler:20.03-LTS-SP1
 before 4.9.3-1.oe1
4.9.3-1.oe1
jss
openEuler:20.03-LTS-SP4
 before 4.9.3-1.oe2003sp4
4.9.3-1.oe2003sp4
jss
Red Hat:enterprise_linux:8::appstream
 before 0:4.9.3-1.module+el8.6.0+14244+60d461b7
0:4.9.3-1.module+el8.6.0+14244+60d461b7
jss-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:4.9.3-1.module+el8.6.0+14244+60d461b7
0:4.9.3-1.module+el8.6.0+14244+60d461b7
jss-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:4.9.3-1.module+el8.6.0+14244+60d461b7
0:4.9.3-1.module+el8.6.0+14244+60d461b7
jss-javadoc
Red Hat:enterprise_linux:8::appstream
 before 0:4.9.3-1.module+el8.6.0+14244+60d461b7
0:4.9.3-1.module+el8.6.0+14244+60d461b7
ldapjdk
Red Hat:enterprise_linux:8::appstream
 before 0:4.23.0-1.module+el8.5.0+11983+6ba118b4
0:4.23.0-1.module+el8.5.0+11983+6ba118b4
ldapjdk-javadoc
Red Hat:enterprise_linux:8::appstream
 before 0:4.23.0-1.module+el8.5.0+11983+6ba118b4
0:4.23.0-1.module+el8.5.0+11983+6ba118b4
pki-acme
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-base
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-base-java
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-ca
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-core
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-core-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-core-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-kra
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-server
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-symkey
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-symkey-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-tools
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
pki-tools-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
python3-pki
Red Hat:enterprise_linux:8::appstream
 before 0:10.12.0-2.module+el8.6.0+14115+8b467244
0:10.12.0-2.module+el8.6.0+14115+8b467244
tomcatjss
Red Hat:enterprise_linux:8::appstream
 before 0:7.7.1-1.module+el8.6.0+13291+248751b1
0:7.7.1-1.module+el8.6.0+13291+248751b1
jss
Red Hat:certificate_system:10.4::el8
 before 0:4.9.8-1.module+el8pki+19895+c800dfbd
0:4.9.8-1.module+el8pki+19895+c800dfbd
redhat-pki
Red Hat:certificate_system:10.4::el8
 before 0:10.13.9-5.module+el8pki+21062+4ed906e8
0:10.13.9-5.module+el8pki+21062+4ed906e8
jss
Rocky Linux:8
 before 0:4.9.3-1.module+el8.6.0+788+76246f77
0:4.9.3-1.module+el8.6.0+788+76246f77
ldapjdk
Rocky Linux:8
 before 0:4.23.0-1.module+el8.7.0+1069+6f3de942
0:4.23.0-1.module+el8.7.0+1069+6f3de942
ldapjdk
Rocky Linux:8
 before 0:4.23.0-1.module+el8.5.0+701+8dc610e5
0:4.23.0-1.module+el8.5.0+701+8dc610e5
pki-core
Rocky Linux:8
 before 0:10.12.0-2.module+el8.6.0+788+76246f77
0:10.12.0-2.module+el8.6.0+788+76246f77
tomcatjss
Rocky Linux:8
 before 0:7.7.1-1.module+el8.6.0+788+76246f77
0:7.7.1-1.module+el8.6.0+788+76246f77
jss
Ubuntu:16.04:LTS
 All versions, plus listed versions
4.3.1-6
 None known
jss
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.4.2-14.4.2-24.4.2-34.4.2-64.4.3-1
 None known
jss
Ubuntu:20.04:LTS
 All versions, plus listed versions
4.6.1-34.6.2-14.6.3-1
 None known
jss
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.8.0-25.0.0-1
 None known
jss
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.4.2-15.5.0-15.5.0-1build1
 None known
jss
Ubuntu:25.10
 All versions, plus listed versions
5.5.0-1build1
 None known
jss
Ubuntu:26.10
 All versions, plus listed versions
5.9.0~beta3-3ubuntu1
 None known
jss
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.5.0-1build15.9.0~beta3-3ubuntu1
 None known

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-4213 is a high vulnerability (CVSS 7.5) in Dogtag Jss, published May 10, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.74%, the 77th percentile. Fixed in jss 4.9.3-1.module_el8.6.0+2764+9fc58d50.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open