{"id":"CVE-2021-4070","aliases":["DEBIAN-CVE-2021-4070","EUVD-2022-0809","GHSA-4cxw-hq44-r344","GO-2022-0550","UBUNTU-CVE-2021-4070"],"status":"published","title":"Off-by-one Error in v2fly/v2ray-core","description":"Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00858,"percentile":0.58703,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-193"],"published":"2022-02-23T19:50:10Z","modified":"2026-10-23T18:03:34Z","fixes":[{"ecosystem":"Go","package":"github.com/v2fly/v2ray-core/v4","fixed_in":["4.44.0"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/v2fly/v2ray-core","fixed_in":["4.44.0"],"sources":["ghsa"]},{"ecosystem":"Debian:12","package":"golang-v2ray-core","fixed_in":["4.34.0-7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-v2ray-core","fixed_in":["4.34.0-7"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-v2ray-core","fixed_in":["4.34.0-7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/v2fly/v2ray-core/v4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.44.0"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/v2fly/v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.44.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.34.0-7"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.34.0-7"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.34.0-7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/v2fly/v2ray-core/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.44.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/v2fly/v2ray-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/v2fly/v2ray-core","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/v2fly/v2ray-core/v4","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"4.44.0"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"golang-v2ray-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.34.0-1","4.34.0-5"]}],"products":[{"vendor":"v2fly","product":"v2fly/v2ray-core"},{"vendor":"v2fly","product":"v2ray-core"}],"references":[{"url":"https://huntr.dev/bounties/8da19456-4d89-41ef-9781-a41efd6a1877","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/v2fly/v2ray-core/commit/c1af2bfd7aa59a4482aa7f6ec4b9208c1d350b5c","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-4070","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4cxw-hq44-r344","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-4070","tags":["advisory"]},{"url":"https://github.com/v2fly/v2ray-core","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2021-4070","tags":["report"]},{"url":"https://huntr.dev/bounties/8da19456-4d89-41ef-9781-a41efd6a1877/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-4070","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-4070","title":"Off-by-one Error in v2fly/v2ray-core","description":"Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.","status":"published","published":"2022-02-23T19:50:10Z","modified":"2024-08-03T17:16:03.674Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:33:08.045407Z"}],"euvd":[{"id":"EUVD-2022-0809","description":"Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.","status":"published","published":"2022-02-23T19:50:10Z","modified":"2024-08-03T17:16:03Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T03:25:10.888157Z"}],"ghsa":[{"id":"GHSA-4cxw-hq44-r344","title":"Off-by-one Error in v2fly/v2ray-core","description":"v2fly/v2ray-core prior to 4.44.0 is vulnerable to an off-by-one error. Indexing operations on arrays, slices, or strings should use an index at most one less than the length. If the index is checked for being less than or equal to the length (`\u003c=`), instead of less than the length (`\u003c`), the index could be out of bounds.","status":"published","published":"2022-02-24T00:00:52Z","modified":"2023-02-03T05:06:26Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:36:43.439065Z"}],"nvd":[{"id":"CVE-2021-4070","description":"Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.","status":"published","published":"2022-02-23T20:15:09.167Z","modified":"2026-06-17T04:18:59.397Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T14:07:04.6896Z"}],"osv":[{"id":"CVE-2021-4070","description":"Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.","status":"published","published":"2022-02-23T20:15:09.167Z","modified":"2026-10-20T10:54:57.928501575Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:21.249056Z"},{"id":"DEBIAN-CVE-2021-4070","description":"Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.","status":"published","published":"2022-02-23T20:15:09.167Z","modified":"2026-10-23T18:03:34.343425899Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:35.521549Z"},{"id":"GHSA-4cxw-hq44-r344","title":"Off-by-one Error in v2fly/v2ray-core","description":"v2fly/v2ray-core prior to 4.44.0 is vulnerable to an off-by-one error. Indexing operations on arrays, slices, or strings should use an index at most one less than the length. If the index is checked for being less than or equal to the length (`\u003c=`), instead of less than the length (`\u003c`), the index could be out of bounds.","status":"published","published":"2022-02-24T00:00:52Z","modified":"2024-08-21T15:27:03.01651Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"cwes":["CWE-193"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"UBUNTU-CVE-2021-4070","description":"Off-by-one Error in GitHub repository v2fly/v2ray-core prior to 4.44.0.","status":"published","published":"2022-02-23T20:15:00Z","modified":"2025-09-08T16:46:51Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:29.220315Z"},{"id":"GO-2022-0550","title":"Off-by-one Error in v2fly/v2ray-core in github.com/v2fly/v2ray-core","description":"Off-by-one Error in v2fly/v2ray-core in github.com/v2fly/v2ray-core","status":"published","published":"2024-08-21T15:11:36Z","modified":"2026-03-03T04:50:31.927824Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}