Every CVE Search/ Get API key

CVE-2021-44541

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by...

7.5 HighFix available

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.44%Up 0.8 points since Dec 24, 2021
90%50%10%1%

What each source reports

NVD Score used 7.5

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
CVE-2021-44541
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:N/I:N/A:P
Weakness
CWE-401
Updated
2026-11-02
CVE List No score

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
CVE-2021-44541
Weakness
CWE-401
Updated
2026-11-02
EUVDEUVD-2021-31372 No score

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
EUVD-2021-31372
Updated
2026-11-03
GitHub AdvisoriesGHSA-m37r-wp9g-cfgf No score

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by...

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
GHSA-m37r-wp9g-cfgf
Weakness
CWE-401
Updated
2026-11-02
OSVALPINE-CVE-2021-44541 7.5

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
ALPINE-CVE-2021-44541
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSV 7.5

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
CVE-2021-44541
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2021-44541 7.5

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
DEBIAN-CVE-2021-44541
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-44541 7.5

A vulnerability was found in Privoxy which was fixed in process_encrypted_request_headers() by freeing header memory when failing to get the request destination.

Record
UBUNTU-CVE-2021-44541
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2021-0570 No score

Updated privoxy packages fix security vulnerabilities

Updated privoxy packages fix security vulnerabilities:

A security issue has been found in Privoxy before version 3.0.33. get_url_spec_param() did not free memory of compiled pattern spec before bailing (CVE-2021-44540).

A security issue has been found in Privoxy before version 3.0.33. process_encrypted_request_headers() did not free header memory when failing to get the request destination (CVE-2021-44541).

A security issue has been found in Privoxy before version 3.0.33. send_http_request() leaked memory when handling errors (CVE-2021-44542).

A security issue has been found in Privoxy before version 3.0.33. cgi_error_no_template() did not encode the template name, which could lead to cross-site scripting when Privoxy is configured to servce the user-manual itself (CVE-2021-44543).

Record
MGASA-2021-0570
Updated
2026-11-02
OSVopenSUSE-SU-2021:1646-1 No score

Security update for privoxy

This update for privoxy fixes the following issues:

privoxy was updated to 3.0.33 (boo#1193584):

  • CVE-2021-44543: Encode the template name to prevent XSS (cross-side scripting) when Privoxy is configured to servce the user-manual itself
  • CVE-2021-44540: Free memory of compiled pattern spec before bailing
  • CVE-2021-44541: Free header memory when failing to get the request destination.
  • CVE-2021-44542: Prevent memory leaks when handling errors
  • Disable fast-redirects for a number of domains
  • Update default block lists
  • Many bug fixes and minor enhancements
Record
openSUSE-SU-2021:1646-1
Updated
2026-11-02
OSVopenSUSE-SU-2022:10186-1 No score

Security update for privoxy

This update for privoxy fixes the following issues:

privoxy was updated to 3.0.33 (boo#1193584):

  • CVE-2021-44543: Encode the template name to prevent XSS (cross-side scripting) when Privoxy is configured to servce the user-manual itself
  • CVE-2021-44540: Free memory of compiled pattern spec before bailing
  • CVE-2021-44541: Free header memory when failing to get the request destination.
  • CVE-2021-44542: Prevent memory leaks when handling errors
  • Disable fast-redirects for a number of domains
  • Update default block lists
  • Many bug fixes and minor enhancements
Record
openSUSE-SU-2022:10186-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11677-1 No score

privoxy-3.0.33-1.1 on GA media

These are all security issues fixed in the privoxy-3.0.33-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11677-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
privoxy
Alpine:v3.12
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.13
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.14
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.15
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.16
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.17
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.18
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.19
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.20
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.21
 before 3.0.33-r0
3.0.33-r0
Show 13 moreShow less
Affected packages
PackageAffectedFixed
privoxy
Alpine:v3.22
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.23
 before 3.0.33-r0
3.0.33-r0
privoxy
Alpine:v3.24
 before 3.0.33-r0
3.0.33-r0
privoxy
Debian:12
 before 3.0.33-1
3.0.33-1
privoxy
Debian:13
 before 3.0.33-1
3.0.33-1
privoxy
Debian:14
 before 3.0.33-1
3.0.33-1
privoxy
Mageia:8
From an advisory covering 4 CVEs
 before 3.0.32-1.1.mga8
3.0.32-1.1.mga8
privoxy
SUSE:Package Hub 15 SP3
From an advisory covering 4 CVEs
 before 3.0.33-bp153.2.3.1
3.0.33-bp153.2.3.1
privoxy
openSUSE:Leap 15.2
From an advisory covering 4 CVEs
 before 3.0.33-bp153.2.3.1
3.0.33-bp153.2.3.1
privoxy
openSUSE:Leap 15.3
From an advisory covering 4 CVEs
 before 3.0.33-bp153.2.3.1
3.0.33-bp153.2.3.1
privoxy
SUSE:Package Hub 15 SP4
From an advisory covering 4 CVEs
 before 3.0.33-bp154.3.3.1
3.0.33-bp154.3.3.1
privoxy
openSUSE:Leap 15.4
From an advisory covering 4 CVEs
 before 3.0.33-bp154.3.3.1
3.0.33-bp154.3.3.1
privoxy
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 3.0.33-1.1
3.0.33-1.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-44541 is a high vulnerability (CVSS 7.5) in Privoxy, published December 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in privoxy 3.0.33-r0.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open