{"id":"CVE-2021-28361","aliases":["AZL-38836","AZL-39466","EUVD-2021-15045","GHSA-f2h7-8qhx-58qw"],"status":"published","title":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU...","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.0114,"percentile":0.67029,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2021-03-13T19:00:31Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"ceph","fixed_in":["18.2.2-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"ceph","fixed_in":["16.2.10-3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"ceph","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.2.10-3"}]}]}],"products":[{"vendor":"spdk","product":"storage_performance_development_kit"}],"references":[{"url":"https://github.com/spdk/spdk/releases/tag/v21.01.1","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28361","tags":["web"]},{"url":"https://github.com/advisories/GHSA-f2h7-8qhx-58qw"}],"sources":{"cve":[{"id":"CVE-2021-28361","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","status":"published","published":"2021-03-13T19:00:31Z","modified":"2024-08-03T21:40:14.251Z","updated_at":"2026-11-02T14:33:09.175141Z"}],"euvd":[{"id":"EUVD-2021-15045","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","status":"published","published":"2021-03-13T19:00:31Z","modified":"2024-08-03T21:40:14Z","updated_at":"2026-11-03T03:24:46.751124Z"}],"ghsa":[{"id":"GHSA-f2h7-8qhx-58qw","title":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU...","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","status":"published","published":"2022-05-24T17:44:31Z","modified":"2023-01-29T05:06:52Z","cwes":["CWE-476"],"updated_at":"2026-11-02T14:46:06.857512Z"}],"nvd":[{"id":"CVE-2021-28361","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","status":"published","published":"2021-03-13T19:15:12.237Z","modified":"2026-06-17T03:46:17.29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"AZL-38836","title":"CVE-2021-28361 affecting package ceph for versions less than 18.2.2-1","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","status":"published","published":"2021-03-13T19:15:12Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.751978Z"},{"id":"AZL-39466","title":"CVE-2021-28361 affecting package ceph for versions less than 16.2.10-3","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","status":"published","published":"2021-03-13T19:15:12Z","modified":"2026-04-21T04:28:44.417231Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.608733Z"},{"id":"CVE-2021-28361","description":"An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.","status":"published","published":"2021-03-13T19:15:12.237Z","modified":"2026-10-20T10:49:40.373107706Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.129331Z"}]}}