CVE-2021-43612
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible...
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
CVE-2021-43612- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
CVE-2021-43612- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2021-30526
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
EUVD-2021-30526- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x6gw-c547-cwm7
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible...
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
GHSA-x6gw-c547-cwm7- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-43612
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
ALPINE-CVE-2021-43612- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSV
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
CVE-2021-43612- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2021-43612
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
DEBIAN-CVE-2021-43612- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:9158
Red Hat Security Advisory: lldpd security update
- Record
RHSA-2024:9158- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-43612
In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.
- Record
UBUNTU-CVE-2021-43612- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2024:9158 No score
Moderate: lldpd security update
LLDP is an industry standard protocol designed to supplant proprietary Link-Layer protocols such as EDP or CDP. The goal of LLDP is to provide an inter-vendor compatible mechanism to deliver Link-Layer notifications to adjacent network devices.
Security Fix(es):
- lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827)
- lldpd: out-of-bounds read when decoding SONMP packets (CVE-2021-43612)
- lldpd: CDP PDU Packet cdp.c out-of-bounds read (CVE-2023-41910)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:9158- Updated
- 2026-11-02
OSVCLSA-2025-1758823952 No score
lldpd: Fix of CVE-2021-43612
- CVE-2021-43612: fix out-of-bounds heap read in sonmp_decode function
- Record
CLSA-2025-1758823952- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11635-1 No score
liblldpctl4-1.0.13-1.1 on GA media
These are all security issues fixed in the liblldpctl4-1.0.13-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11635-1- Updated
- 2026-11-02
OSVRLSA-2024:9158 No score
Moderate: lldpd security update
LLDP is an industry standard protocol designed to supplant proprietary Link-Layer protocols such as EDP or CDP. The goal of LLDP is to provide an inter-vendor compatible mechanism to deliver Link-Layer notifications to adjacent network devices.
Security Fix(es):
-
lldp/openvswitch: denial of service via externally triggered memory leak (CVE-2020-27827)
-
lldpd: out-of-bounds read when decoding SONMP packets (CVE-2021-43612)
-
lldpd: CDP PDU Packet cdp.c out-of-bounds read (CVE-2023-41910)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.
- Record
RLSA-2024:9158- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lldpdAlpine:v3.14 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.15 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.16 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.17 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.18 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.19 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.20 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.21 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.22 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlpine:v3.23 |
before 1.0.13-r0 | 1.0.13-r0 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
lldpdAlpine:v3.24 |
before 1.0.13-r0 | 1.0.13-r0 |
lldpdAlmaLinux:9 From an advisory covering 3 CVEs |
before 1.0.18-4.el9 | 1.0.18-4.el9 |
lldpd-develAlmaLinux:9 From an advisory covering 3 CVEs |
before 1.0.18-4.el9 | 1.0.18-4.el9 |
lldpdTuxCare:AlmaLinux:9.2 |
before 1.0.4-10.el9.tuxcare.els3 | 1.0.4-10.el9.tuxcare.els3 |
lldpd-develTuxCare:AlmaLinux:9.2 |
before 1.0.4-10.el9.tuxcare.els3 | 1.0.4-10.el9.tuxcare.els3 |
lldpdDebian:12 |
before 1.0.13-1 | 1.0.13-1 |
lldpdDebian:13 |
before 1.0.13-1 | 1.0.13-1 |
lldpdDebian:14 |
before 1.0.13-1 | 1.0.13-1 |
lldpdDebian:10 From an advisory covering 2 CVEs |
before 1.0.3-1+deb10u1, plus listed versions 1.0.3-1 |
1.0.3-1+deb10u1 |
lldpdRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 0:1.0.18-4.el9 | 0:1.0.18-4.el9 |
lldpd-debuginfoRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 0:1.0.18-4.el9 | 0:1.0.18-4.el9 |
lldpd-debugsourceRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 0:1.0.18-4.el9 | 0:1.0.18-4.el9 |
lldpd-develRed Hat:enterprise_linux:9::appstream From an advisory covering 3 CVEs |
before 0:1.0.18-4.el9 | 0:1.0.18-4.el9 |
lldpdRocky Linux:9 From an advisory covering 3 CVEs |
before 0:1.0.18-4.el9 | 0:1.0.18-4.el9 |
lldpdUbuntu:16.04:LTS |
All versions, plus listed versions 0.7.16-10.7.19-1 |
None known |
lldpdUbuntu:18.04:LTS |
All versions, plus listed versions 0.9.8-10.9.9-10.9.9-1ubuntu0.1 |
None known |
lldpdUbuntu:20.04:LTS |
All versions, plus listed versions 1.0.4-11.0.4-1build11.0.4-1build2 |
None known |
lldpdUbuntu:22.04:LTS |
All versions, plus listed versions 1.0.11-11.0.12-11.0.13-1 |
None known |
lldpdUbuntu:24.04:LTS |
All versions, plus listed versions 1.0.17-11.0.18-11.0.18-1build11.0.18-1build31.0.18-1ubuntu0.1 |
None known |
lldpdUbuntu:25.10 |
All versions, plus listed versions 1.0.18-1build31.0.18-1build4 |
None known |
lldpdUbuntu:26.10 |
All versions, plus listed versions 1.0.19-11.0.22-11.0.22-1build1 |
None known |
lldpdUbuntu:26.04:LTS |
All versions, plus listed versions 1.0.18-1build41.0.19-11.0.19-1ubuntu0.1 |
None known |
lldpdopenSUSE:Tumbleweed |
before 1.0.13-1.1 | 1.0.13-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-43612 is a high vulnerability (CVSS 7.5) in Lldpd Project Lldpd, published April 10, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.14%, the 66th percentile. Fixed in lldpd 1.0.13-r0.
References
lldpd.github.io/security.html
github.com/lldpd/lldpd/commit/73d42680fce8598324364dbb31b9bc3b8320adf7
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP
Show 34 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-43612
security.alpinelinux.org/vuln/CVE-2021-43612
access.redhat.com/errata/RHSA-2024:9158
bugzilla.redhat.com/1921438
errata.almalinux.org/9/ALSA-2024-9158.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1758823952.html
security-tracker.debian.org/tracker/CVE-2021-43612
docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
issues.redhat.com/browse/RHEL-22127
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9158.json
cve.org/CVERecord?id=CVE-2020-27827
mail.openvswitch.org/pipermail/ovs-dev/2021-January/379471.html
errata.rockylinux.org/RLSA-2024:9158
ubuntu.com/security/CVE-2021-43612
suse.com/security/cve/CVE-2021-43612