{"id":"CVE-2021-3618","aliases":["ALPINE-CVE-2021-3618","AZL-9188","AZL-9190","AZL-9220","BELL-CVE-2021-3618","BIT-nginx-2021-3618","BIT-nginx-gateway-2021-3618","CLSA-2022-1649695619","CLSA-2022-1649695737","CLSA-2022-1649695783","CLSA-2022-1649696332","CLSA-2022-1649696379","DEBIAN-CVE-2021-3618","DLA-3203-1","EUVD-2021-26922","GHSA-r9r5-jxp7-whr4","MGASA-2021-0540","OESA-2022-1637","SUSE-RU-2022:0655-1","SUSE-SU-2022:3320-1","SUSE-SU-2022:3383-1","SUSE-SU-2022:3457-1","SUSE-SU-2022:3458-1","SUSE-SU-2022:3888-1","SUSE-SU-2022:4192-1","SUSE-SU-2022:4201-1","SUSE-SU-2022:4265-1","SUSE-SU-2022:4266-1","UBUNTU-CVE-2021-3618","USN-5371-1","USN-5371-2","USN-6379-1"],"status":"published","title":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers...","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02027,"percentile":0.81184,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-12-08T20:04:18Z","modified":"2026-11-05T19:01:03Z","fixes":[{"ecosystem":"Alpine:v3.14","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"nginx","fixed_in":["1.20.1-r1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"nginx","fixed_in":["1.20.2-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"vsftpd","fixed_in":["3.0.5-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx","fixed_in":["1.21.0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"nginx-gateway","fixed_in":["1.21.0"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-all-modules","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-filesystem","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-geoip","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-image-filter","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-perl","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-xslt-filter","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-mail","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-stream","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-common","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-core","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-doc","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-extras","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-full","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-light","fixed_in":["1.10.3-0ubuntu0.16.04.8+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-all-modules","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-filesystem","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-geoip","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-image-filter","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-perl","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-xslt-filter","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-mail","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-stream","fixed_in":["1.10.3-4.el6.tuxcare.els4"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-all-modules","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-filesystem","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-image-filter","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-perl","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-mail","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-stream","fixed_in":["1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-all-modules","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-filesystem","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-image-filter","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-perl","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-xslt-filter","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-mail","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-stream","fixed_in":["1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nginx","fixed_in":["1.20.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nginx","fixed_in":["1.20.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nginx","fixed_in":["1.20.2-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"sendmail","fixed_in":["8.16.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"sendmail","fixed_in":["8.16.1-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"sendmail","fixed_in":["8.16.1-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"vsftpd","fixed_in":["3.0.5-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"vsftpd","fixed_in":["3.0.5-0.1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"nginx","fixed_in":["1.18.0-5.2.mga8"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"vsftpd","fixed_in":["3.0.5-1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nginx","fixed_in":["1.21.5-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"nginx","fixed_in":["1.21.5-1.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nginx","fixed_in":["1.21.5-1.oe2203"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vsftpd","fixed_in":["3.0.5-48.3.1","3.0.5-47.7.1","3.0.5-51.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vsftpd","fixed_in":["3.0.5-48.3.1","3.0.5-47.7.1","3.0.5-51.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"vsftpd","fixed_in":["3.0.5-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"vsftpd","fixed_in":["3.0.5-150400.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"vsftpd","fixed_in":["3.0.5-150200.12.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"vsftpd","fixed_in":["3.0.5-150000.7.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nginx","fixed_in":["1.16.1-150000.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nginx","fixed_in":["1.16.1-150000.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nginx","fixed_in":["1.16.1-150000.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nginx","fixed_in":["1.16.1-150000.3.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"nginx","fixed_in":["1.19.8-150300.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"nginx","fixed_in":["1.19.8-150300.3.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"nginx","fixed_in":["1.19.8-150300.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"nginx","fixed_in":["1.16.1-150200.3.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nginx","fixed_in":["1.16.1-150100.6.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nginx","fixed_in":["1.16.1-150100.6.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nginx","fixed_in":["1.16.1-150100.6.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nginx","fixed_in":["1.16.1-150100.6.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nginx","fixed_in":["1.16.1-150100.6.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"nginx","fixed_in":["1.16.1-150100.6.16.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","fixed_in":["1.10.3-0ubuntu0.16.04.5+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"nginx","fixed_in":["1.14.0-0ubuntu1.10"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nginx","fixed_in":["1.18.0-0ubuntu1.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"vsftpd","fixed_in":["3.0.5-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nginx","fixed_in":["1.18.0-6ubuntu14.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-r1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.15.2-46"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"nginx-gateway","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.21.0"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-extras","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-full","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"nginx-light","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.8+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-geoip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-4.el6.tuxcare.els4"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.5","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.5.0+2024+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-all-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-filesystem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-image-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-http-xslt-filter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-mail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:8.4","package":"nginx-mod-stream","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.14.1-9.module_el8.4.0+2023+af250afe.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.2-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.1-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.1-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.16.1-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-13","3.0.3-13.1","3.0.5-0.1","3.0.5-0.2","3.0.5-0.3","3.0.5-0.4","3.0.5-0.5","3.0.5-0.6","3.0.5-0.7","3.0.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-0.1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-2+deb10u5"}]}],"versions":["1.14.2-2","1.14.2-2+deb10u1","1.14.2-2+deb10u2","1.14.2-2+deb10u3","1.14.2-2+deb10u4"],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-5.2.mga8"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.5-1.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-48.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-48.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150400.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-47.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-47.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150200.12.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-150000.7.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-51.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-51.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150000.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150000.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150000.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150000.3.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.8-150300.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.8-150300.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.8-150300.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150200.3.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150100.6.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150100.6.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150100.6.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150100.6.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150100.6.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150100.6.16.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.1-3ubuntu1","1.4.3-2ubuntu1","1.4.4-1ubuntu1","1.4.4-2ubuntu1","1.4.4-4ubuntu1","1.4.5-1ubuntu1","1.4.6-1ubuntu2","1.4.6-1ubuntu3","1.4.6-1ubuntu3.1","1.4.6-1ubuntu3.2","1.4.6-1ubuntu3.3","1.4.6-1ubuntu3.4","1.4.6-1ubuntu3.5","1.4.6-1ubuntu3.6","1.4.6-1ubuntu3.7","1.4.6-1ubuntu3.8","1.4.6-1ubuntu3.9","1.4.6-1ubuntu3.9+esm1","1.4.6-1ubuntu3.9+esm2","1.4.6-1ubuntu3.9+esm3","1.4.6-1ubuntu3.9+esm4","1.4.6-1ubuntu3.9+esm5","1.4.6-1ubuntu3.9+esm6","1.4.6-1ubuntu3.9+esm8","1.4.6-1ubuntu3.9+esm9"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.4-2.1ubuntu4","8.14.4-2.1ubuntu5","8.14.4-4.1ubuntu1","8.14.4-4.1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-1ubuntu2","3.0.2-1ubuntu2.14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm3"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.2-20ubuntu1","3.0.3-1ubuntu1","3.0.3-2ubuntu1","3.0.3-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.14.9-4","8.15.2-2","8.15.2-3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.10"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.3-9","3.0.3-9build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.15.2-8ubuntu1","8.15.2-9ubuntu1","8.15.2-10"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.3"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-0ubuntu0.20.04.1"}]}],"versions":["3.0.3-12"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.15.2-13","8.15.2-17ubuntu1","8.15.2-18"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.1"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"sendmail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.15.2-22ubuntu2","8.15.2-22ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.3-0ubuntu0.16.04.5+esm3"}]}],"versions":["1.9.3-1ubuntu1","1.9.6-2ubuntu1","1.9.6-2ubuntu2","1.9.9-0ubuntu1","1.9.9-1ubuntu1","1.9.10-0ubuntu1","1.9.10-1ubuntu1","1.9.11-0ubuntu1","1.9.11-0ubuntu2","1.9.12-0ubuntu1","1.9.13-0ubuntu1","1.9.14-0ubuntu1","1.9.15-0ubuntu1","1.10.0-0ubuntu0.16.04.1","1.10.0-0ubuntu0.16.04.2","1.10.0-0ubuntu0.16.04.3","1.10.0-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.1","1.10.3-0ubuntu0.16.04.2","1.10.3-0ubuntu0.16.04.3","1.10.3-0ubuntu0.16.04.4","1.10.3-0ubuntu0.16.04.5","1.10.3-0ubuntu0.16.04.5+esm1","1.10.3-0ubuntu0.16.04.5+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.0-0ubuntu1.10"}]}],"versions":["1.12.1-0ubuntu2","1.13.6-2ubuntu1","1.13.6-2ubuntu2","1.13.10-1ubuntu1","1.13.12-0ubuntu1","1.14.0-0ubuntu1","1.14.0-0ubuntu1.1","1.14.0-0ubuntu1.2","1.14.0-0ubuntu1.3","1.14.0-0ubuntu1.4","1.14.0-0ubuntu1.5","1.14.0-0ubuntu1.6","1.14.0-0ubuntu1.7","1.14.0-0ubuntu1.9"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-0ubuntu1.3"}]}],"versions":["1.16.1-0ubuntu2","1.16.1-0ubuntu3","1.17.5-0ubuntu1","1.17.6-0ubuntu1","1.17.7-0ubuntu1","1.17.8-0ubuntu1","1.17.8-0ubuntu2","1.17.8-0ubuntu3","1.17.9-0ubuntu1","1.17.9-0ubuntu2","1.17.9-0ubuntu3","1.17.10-0ubuntu1","1.18.0-0ubuntu1","1.18.0-0ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nginx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.0-6ubuntu14.1"}]}],"versions":["1.18.0-6ubuntu11","1.18.0-6ubuntu12","1.18.0-6ubuntu14"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"vsftpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-0ubuntu0.20.04.1"}]}],"versions":["3.0.3-12"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"f5","product":"nginx"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"sendmail","product":"sendmail"},{"vendor":"vsftpd_project","product":"vsftpd"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1975623","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://alpaca-attack.com/","tags":["x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/11/msg00031.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3618","tags":["web","advisory"]},{"url":"https://github.com/nginx/nginx/commit/173f16f736c10eae46cd15dd861b04b82d91a37a"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991328"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991329"},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991331"},{"url":"https://ubuntu.com/security/CVE-2021-3618","tags":["report"]},{"url":"https://github.com/advisories/GHSA-r9r5-jxp7-whr4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-3618","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-3618","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/els6/CLSA-2022-1649695619.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu16_04/CLSA-2022-1649695737","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ol6/CLSA-2022-1649695783.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.5-els/CLSA-2022-1649696332.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/centos8.4-els/CLSA-2022-1649696379.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-3618","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0540.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29220","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/44SPREQ2R4IE2VUUO2HVCFTUGDCYSXAD/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TKXMYKALTHIBJLDHQPBKNQK2FWVOSIG7/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1637","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/-2022-655/suse-ru-20220655-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1042673","tags":["report"]},{"url":"https://bugzilla.suse.com/1070653","tags":["report"]},{"url":"https://bugzilla.suse.com/1083705","tags":["report"]},{"url":"https://bugzilla.suse.com/1089088","tags":["report"]},{"url":"https://bugzilla.suse.com/1125951","tags":["report"]},{"url":"https://bugzilla.suse.com/1144062","tags":["report"]},{"url":"https://bugzilla.suse.com/1179553","tags":["report"]},{"url":"https://bugzilla.suse.com/1180314","tags":["report"]},{"url":"https://bugzilla.suse.com/1181400","tags":["report"]},{"url":"https://bugzilla.suse.com/1187188","tags":["report"]},{"url":"https://bugzilla.suse.com/1187686","tags":["report"]},{"url":"https://bugzilla.suse.com/786024","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3618","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223320-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1021387","tags":["report"]},{"url":"https://bugzilla.suse.com/1052900","tags":["report"]},{"url":"https://bugzilla.suse.com/1187678","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223383-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223457-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/971784","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223458-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223888-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224192-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1187685","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224201-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224265-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224266-1/","tags":["advisory"]},{"url":"https://security.appspot.com/vsftpd/Changelog.txt","tags":["report"]},{"url":"https://marc.info/?l=sendmail-announce\u0026m=159394546814125\u0026w=2","tags":["report"]},{"url":"https://lists.exim.org/lurker/message/20210609.200324.f0e073ed.el.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5371-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5371-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6379-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-3618","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-11724","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-36309","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T00:00:00Z","modified":"2024-08-03T17:01:07.459Z","cwes":["CWE-295"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-26922","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T00:00:00Z","modified":"2024-08-03T17:01:07Z","updated_at":"2026-11-03T03:25:12.535968Z"}],"ghsa":[{"id":"GHSA-r9r5-jxp7-whr4","title":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers...","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-24T00:00:17Z","modified":"2023-02-02T05:01:40Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:51:13.974749Z"}],"nvd":[{"id":"CVE-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:09.833Z","modified":"2026-06-17T04:05:27.083Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:07:05.581807Z"}],"osv":[{"id":"ALPINE-CVE-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:09.833Z","modified":"2026-10-23T17:17:56.199330427Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-9188","title":"CVE-2021-3618 affecting package nginx for versions less than 1.20.2-2","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:09Z","modified":"2026-04-21T04:34:59.80362Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"AZL-9190","title":"CVE-2021-3618 affecting package vsftpd for versions less than 3.0.5-1","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:09Z","modified":"2026-04-21T04:34:59.846806Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:11.397546Z"},{"id":"AZL-9220","title":"CVE-2021-3618 affecting package sendmail 8.15.2-46","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:09Z","modified":"2026-04-21T04:34:59.788831Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"BELL-CVE-2021-3618","title":"CVE-2021-3618 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:43.768323Z","modified":"2026-01-26T09:46:46.605033Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:09.833Z","modified":"2026-10-24T10:30:41.363399125Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:20.434873Z"},{"id":"DEBIAN-CVE-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:09.833Z","modified":"2026-10-23T18:03:50.155507672Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"OESA-2022-1637","title":"nginx security update","description":"NGINX is a free, open-source, high-performance HTTP server and reverse proxy, as well as an IMAP/POP3 proxy server.\r\n\r\nSecurity Fix(es):\nALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.(CVE-2021-3618)","status":"published","published":"2022-05-11T11:04:54Z","modified":"2026-08-18T01:16:31.145068396Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2022-03-23T20:15:00Z","modified":"2026-11-05T19:01:03.364749585Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-05T19:27:36.688147Z"},{"id":"BIT-nginx-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2024-03-06T10:59:22.065Z","modified":"2026-09-08T08:48:16.855662913Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"BIT-nginx-gateway-2021-3618","description":"ALPACA is an application layer protocol content confusion attack, exploiting TLS servers implementing different protocols but using compatible certificates, such as multi-domain or wildcard certificates. A MiTM attacker having access to victim's traffic at the TCP/IP layer can redirect traffic from one subdomain to another, resulting in a valid TLS session. This breaks the authentication of TLS and cross-protocol attacks may be possible where the behavior of one protocol service may compromise the other at the application layer.","status":"published","published":"2025-12-03T11:44:15.054Z","modified":"2026-09-08T08:48:16.181190957Z","updated_at":"2026-11-02T15:28:34.007508Z"},{"id":"CLSA-2022-1649695619","title":"Fix of CVE: CVE-2021-3618","description":"- CVE-2021-3618: drop the connection after reaching the specified number of\n  invalid protocol commmands","status":"published","published":"2022-04-11T16:46:59Z","modified":"2026-06-01T00:33:15.38455612Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1649695737","title":"Fix CVE(s): CVE-2021-3618","description":"\n   * SECURITY UPDATE: Vulnerability against application layer\n     protocol content confusion attack\n     - debian/patches/CVE-2021-3618.patch: Drop the connection after\n       reaching the specified number of invalid protocol commmands\n     - CVE-2021-3618","status":"published","published":"2022-04-11T16:48:57Z","modified":"2026-06-04T10:03:23.262558Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1649695783","title":"Fixed CVE-2021-3618 in nginx","description":"- CVE-2021-3618: drop the connection after reaching the specified number of\n  invalid protocol commmands","status":"published","published":"2022-04-11T16:49:43Z","modified":"2026-06-01T00:33:24.542981737Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1649696332","title":"Fix of CVE: CVE-2021-3618","description":"- CVE-2021-3618: drop the connection after reaching the specified number of\n  invalid protocol commmands","status":"published","published":"2022-04-11T16:58:52Z","modified":"2026-06-01T00:33:13.458488496Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"CLSA-2022-1649696379","title":"Fix of CVE: CVE-2021-3618","description":"- CVE-2021-3618: drop the connection after reaching the specified number of\n  invalid protocol commmands","status":"published","published":"2022-04-11T16:59:39Z","modified":"2026-06-01T00:31:23.015006072Z","updated_at":"2026-11-02T15:43:39.801198Z"},{"id":"DLA-3203-1","title":"nginx - security update","status":"published","published":"2022-11-23T00:00:00Z","modified":"2026-03-09T01:18:01.940396Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2021-0540","title":"Updated nginx/vsftpd packages fix security vulnerability","description":"ALPACA: Application Layer Protocol Confusion - Analyzing and Mitigating\nCracks in TLS Authentication\n","status":"published","published":"2021-12-08T20:04:18Z","modified":"2026-04-16T04:40:39.412942511Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"SUSE-RU-2022:0655-1","title":"Recommended update for vsftpd","description":"This update for vsftpd fixes the following issues:\n\nThis update enables vsftpd to speak TLS 1.3 in ssl FTP mode by linking against openssl 1.1.1.\n\nBugfixes added:\n\n- Fixed a seccomp failure in FIPS mode when SSL was enabled. [bsc#1052900]\n- allow stat() to be called, which is required during SSL initialization by RAND_load_file().\n- allow wait4() to be called so that the broker can wait for its child processes. [bsc#1021387]\n- Revert the 'ssl_tlsv1_X'-style config file options back to their\n  original spelling. The changes that dropped the underscore from\n  the version numbers in release 3.0.4 breaks existing\n  configurations and it was never documented anywhere -- not in the\n  package's changelog and not in the packages's own man page.\n- vsftpd follows the system-wide TLS cipher policy 'DEFAULT_SUSE' by\n  default. Run the command 'openssl ciphers -v DEFAULT_SUSE' to see\n  which ciphers this includes.\n- allow sendto() syscall when /dev/log support is enabled. [bsc#786024]\n- allow sendto() to be called from check_limits(), which is necessary for\n  vsftpd to write to the system log.\n- Added hardening to systemd service(s) (bsc#1181400).\n\nUpdate to version 3.0.5:\n\n* Fix ALPN callback to correctly select the 'ftp' string if present.\n  Works with FileZilla-3.55.0.\n* Fix a couple of seccomp policy issues with Fedora 34.\n\nUpdate to version 3.0.4.\n\n* Fix runtime SIGSYS crashes (seccomp sandbox policy tweaks).\n* Reject HTTP verbs pre-login.\n* Disable TLS prior to v1.2 by default.\n* Close the control connection after 10 unknown commands pre-login.\n* Reject any TLS ALPN advertisement that's not 'ftp'.\n* Add ssl_sni_hostname option to require a match on incoming SNI hostname.\n* The options 'ssl_tlsv1_1', 'ssl_tlsv1_2', and 'ssl_tlsv1_3'\n  have been renamed to 'ssl_tlsv11', 'ssl_tlsv12', and\n  'ssl_tlsv13' respectively. Note that the man page has not been\n  updated accordingly.\n\n- OpenSSL was updated to version 1.1.1 in SLE-15-SP2, adding\n  support for the TLSv1.3 protocol. As a consequence, some SLE-15\n  applications that link OpenSSL for TLS support -- like vsftpd --,\n  gained the ability to use the newer TLS protocol, which created\n  interoperability problems with FTP clients in some cases. To\n  remedy the situation, '0001-Introduce-TLSv1.3-option.patch' was\n  applied in a forked SLE-15-SP2 version of vsftpd. The patch adds\n  the configuration option 'ssl_tlsv1_3' that system administrators\n  can use to disable TLSv1.3 support on their servers.\n  [bsc#1187188]\n\n- allow getdents64 syscall in seccomp sandbox, fixes bsc#1179553\n- Add pam_keyinit.so to PAM config file.  [bsc#1144062]\n- Fixed a segmentation fault that occurred while trying to write to an\n  invalid TLS context. [bsc#1125951]\n- Enable wait4(), sysinfo(), and shutdown() syscalls in seccomp sandbox.\n  These are required for the daemon to work properly on SLE-15. [bsc#1089088,\n  bsc#1180314]\n- Add firewalld service file (bsc#1083705)\n- Make sure to also require group nobody and user ftp bsc#1070653\n- Fixed interoperability issue with various ftp clients that arose when\n  vsftpd is configured with option 'use_localtime=YES'. Basically, it's\n  fine to use local time stamps in directory listings, but responding\n  to MDTM commands with any time zone other than UTC directly violates\n  RFC3659 and leads FTP clients to misinterpret the file's time\n  stamp. [bsc#1024961]\n\n- Conditionally install xinetd service only on older releases\n  * On current distributions we support the same functionality\n    via systemd socket activation\n- Fix build against OpenSSL 1.1.  (bsc#1042673)\n\n- Version bump to 3.0.3:\n\n* Increase VSFTP_AS_LIMIT to 200MB; various reports.\n* Make the PWD response more RFC compliant; report from Barry Kelly\n  \u003cbarry@modeltwozero.com\u003e.\n* Remove the trailing period from EPSV response to work around BT Internet\n  issues; report from Tim Bishop \u003ctdb@mirrorservice.org\u003e.\n* Fix syslog_enable issues vs. seccomp filtering. Report from Michal Vyskocil\n  \u003cmvyskocil@suse.cz\u003e. At least, syslogging seems to work on my Fedora now.\n* Allow gettimeofday() in the seccomp sandbox. I can't repro failures, but I\n  probably have a different distro / libc / etc. and there are multiple reports.\n* Some kernels support PR_SET_NO_NEW_PRIVS but not PR_SET_SECCOMP, so handle\n  this case gracefully. Report from Vasily Averin \u003cvvs@odin.com\u003e.\n* List the TLS1.2 cipher AES128-GCM-SHA256 as first preference by default.\n* Make some compile-time SSL defaults (such as correct client shutdown\n  handling) stricter.\n* Disable Nagle algorithm during SSL data connection shutdown, to avoid 200ms\n  delays. From Tim Kosse \u003ctim.kosse@filezilla-project.org\u003e.\n* Kill the FTP session if we see HTTP protocol commands, to avoid\n  cross-protocol attacks. A report from Jann Horn \u003cjann@thejh.net\u003e.\n* Kill the FTP session if we see session re-use failure. A report from\n  Tim Kosse \u003ctim.kosse@filezilla-project.org\u003e.\n* Enable ECDHE, Tim Kosse \u003ctim.kosse@filezilla-project.org\u003e.\n* Default cipher list is now just ECDHE-RSA-AES256-GCM-SHA384.\n* Minor SSL logging improvements.\n* Un-default tunable_strict_ssl_write_shutdown again. We still have\n  tunable_strict_ssl_read_eof defaulted now, which is the important one to prove\n  upload integrity.\n","status":"published","published":"2022-03-24T11:04:18Z","modified":"2026-02-04T02:26:15.758904Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2022:3320-1","title":"Security update for vsftpd","description":"This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (bsc#1187678, bsc#1187686, PM-3322).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n","status":"published","published":"2022-09-20T12:47:13Z","modified":"2026-02-04T04:15:55.262881Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3383-1","title":"Security update for vsftpd","description":"This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, bsc#1187686, bsc#1187678).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n","status":"published","published":"2022-09-26T10:34:31Z","modified":"2026-02-04T03:29:25.937187Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3457-1","title":"Security update for vsftpd","description":"This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, jsc#SLE-23896, bsc#1187686, bsc#1187678).\n- Added hardening to systemd services (bsc#1181400).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Fixed hang when using seccomp and syslog (bsc#971784).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n","status":"published","published":"2022-09-28T15:11:47Z","modified":"2026-02-04T03:51:56.386993Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3458-1","title":"Security update for vsftpd","description":"This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, jsc#SLE-23895, bsc#1187686, bsc#1187678).\n- Added hardening to systemd services (bsc#1181400).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Fixed hang when using seccomp and syslog (bsc#971784).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n","status":"published","published":"2022-09-28T15:13:09Z","modified":"2026-02-04T03:21:18.446185Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3888-1","title":"Security update for vsftpd","description":"This update for vsftpd fixes the following issues:\n\n- CVE-2021-3618: Enforced security checks against ALPACA attack (PM-3322, bsc#1187686, bsc#1187678).\n\nBugfixes:\n- Fixed a seccomp failure in FIPS mode when SSL was enabled (bsc#1052900).\n- Allowed wait4() to be called so that the broker can wait for its child processes (bsc#1021387).\n- Allowed sendto() syscall when /dev/log support is enabled (bsc#786024).\n","status":"published","published":"2022-11-07T13:24:18Z","modified":"2026-02-04T03:47:20.669521Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4192-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n","status":"published","published":"2022-11-23T10:05:21Z","modified":"2026-02-04T02:20:59.100365Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4201-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n","status":"published","published":"2022-11-23T14:34:36Z","modified":"2026-02-04T02:59:03.477263Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:4265-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n","status":"published","published":"2022-11-29T10:22:39Z","modified":"2026-02-04T02:27:36.258668Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4266-1","title":"Security update for nginx","description":"This update for nginx fixes the following issues:\n\n- CVE-2021-3618: Fixed the ALPACA attack limiting the number of errors after which the connection is closed (bsc#1187685).\n","status":"published","published":"2022-11-29T10:23:14Z","modified":"2026-02-04T02:16:28.010145Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5371-1","title":"nginx vulnerabilities","description":"It was discovered that nginx Lua module mishandled certain inputs.\nAn attacker could possibly use this issue to perform an HTTP Request\nSmuggling attack. This issue was fixed for Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-11724)\n\nIt was discovered that nginx Lua module mishandled certain inputs.\nAn attacker could possibly use this issue to disclose sensitive\ninformation. This issue only affects Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-36309)\n\nIt was discovered that nginx mishandled the use of \ncompatible certificates among multiple encryption protocols. \nIf a remote attacker were able to intercept the communication, \nthis issue could be used to redirect traffic between subdomains.\n(CVE-2021-3618)\n","status":"published","published":"2022-04-12T15:48:57Z","modified":"2026-06-25T13:31:07.553074253Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5371-2","title":"nginx vulnerability","description":"USN-5371-1 fixed several vulnerabilities in nginx.\nThis update provides the fix for CVE-2021-3618 for Ubuntu 22.04 LTS.\n\nOriginal advisory details:\n\n It was discovered that nginx Lua module mishandled certain inputs.\n An attacker could possibly use this issue to perform an HTTP Request\n Smuggling attack. This issue was fixed for Ubuntu 18.04 LTS and\n Ubuntu 20.04 LTS. (CVE-2020-11724)\n \n It was discovered that nginx Lua module mishandled certain inputs.\n An attacker could possibly use this issue to disclose sensitive\n information. This issue only affects Ubuntu 18.04 LTS and\n Ubuntu 20.04 LTS. (CVE-2020-36309)\n \n It was discovered that nginx mishandled the use of \n compatible certificates among multiple encryption protocols. \n If a remote attacker were able to intercept the communication, \n this issue could be used to redirect traffic between subdomains.\n (CVE-2021-3618)\n","status":"published","published":"2022-04-28T08:34:24Z","modified":"2026-04-27T19:02:17.407531Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-6379-1","title":"vsftpd vulnerability","description":"It was discovered that vsftpd was vulnerable to the ALPACA TLS protocol\ncontent confusion attack. A remote attacker could possibly use this issue\nto redirect traffic from one subdomain to another.\n","status":"published","published":"2023-09-18T13:38:36Z","modified":"2026-04-27T16:52:02.970983Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}