Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2021-27506: The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is sub

37
Routine
MEDIUM 5.5UPGRADEUPGRADEUPGRADE

CVE-2021-27506 is a medium-severity flaw (CVSS 5.5) affecting netasq, stormshield network security, clamav. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0. This issue is fixed in SNS 3.7.19, 3.11.7 and 4.2.1.

Why this priority

  • No elevated risk signals yet

A fixed release or distro patch exists.

Risk facts

CVSS score5.5 (Medium)
Attack vectorLocal
Attack complexityLow
Privileges neededNone
User interactionRequired
EPSS exploit chance1.3% (top 29%)
CISA exploited listNo
Published2021-03-19
Last modified2026-06-17
Publisher (CNA): MITRE · Vendor: clamav · netasq project · stormshield

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

netasq project netasq UPGRADE
Affected: >= 9.1.0 and <= 9.1.11
Fixed in: newer than 9.1.11
Safe to downgrade to: a release before 9.1.0
1. Check installed version
apt-cache policy netasq || rpm -q netasq || netasq --version
2. UPGRADE to newer than 9.1.11 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade netasq
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade netasq
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 9.1.0 (Debian / Ubuntu)
apt-cache madison netasq sudo apt install netasq=<VERSION_BEFORE_9.1.0> sudo apt-mark hold netasq
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list netasq sudo dnf downgrade netasq-<VERSION_BEFORE_9.1.0> sudo dnf versionlock add netasq
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
stormshield stormshield network security UPGRADE
Affected: >= 1.0 and <= 4.2.0
Fixed in: newer than 4.2.0
Safe to downgrade to: a release before 1.0
1. Check installed version
apt-cache policy stormshield-network-security || rpm -q stormshield-network-security || stormshield-network-security --version
2. UPGRADE to newer than 4.2.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade stormshield-network-security
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade stormshield-network-security
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.0 (Debian / Ubuntu)
apt-cache madison stormshield-network-security sudo apt install stormshield-network-security=<VERSION_BEFORE_1.0> sudo apt-mark hold stormshield-network-security
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list stormshield-network-security sudo dnf downgrade stormshield-network-security-<VERSION_BEFORE_1.0> sudo dnf versionlock add stormshield-network-security
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
clamav clamav UPGRADE
Affected: <= 0.103.1
Fixed in: newer than 0.103.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy clamav || rpm -q clamav || clamav --version
2. UPGRADE to newer than 0.103.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade clamav
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade clamav
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-27506?

netasq: upgrade to newer than 9.1.11; stormshield network security: upgrade to newer than 4.2.0; clamav: upgrade to newer than 0.103.1. Exact commands for each OS are on this page.

Is CVE-2021-27506 being exploited?

CVE-2021-27506 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-27506 affect?

CVE-2021-27506 affects netasq, stormshield network security, clamav. Severity is medium (CVSS 5.5). The ClamAV Engine (version 0.103.1 and below) component embedded in Storsmshield Network Security (SNS) is subject to DoS in case of parsing of malformed png files. This affect Netasq versions 9.1.0 to 9.1.11 and SNS versions 1.0.0 to 4.2.0

How urgent is CVE-2021-27506?

Priority 37/100. No elevated risk signals yet.

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.