PatchTheCVECVE-2021-33913: libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary
CVE-2021-33913 is a critical-severity flaw (CVSS 9.8) affecting libspf2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_expand_data in spf_expand.c. The amount of overflowed data depends on the relationship between the length of an entire domain name and the length of its leftmost label. The vulnerable code may be part of the supp
Why this priority
- Critical severity
- EPSS top 5%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 9.6% (top 5%) |
| CISA exploited list | No |
| Weakness | CWE-787 |
| Published | 2022-01-19 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-33913?
libspf2: upgrade to 1.2.11. Exact commands for each OS are on this page.
Is CVE-2021-33913 being exploited?
CVE-2021-33913 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-33913 affect?
CVE-2021-33913 affects libspf2. Severity is critical (CVSS 9.8). libspf2 before 1.2.11 has a heap-based buffer overflow that might allow remote attackers to execute arbitrary code (via an unauthenticated e-mail message from anywhere on the Internet) with a crafted SPF DNS record, because of SPF_record_ex
How urgent is CVE-2021-33913?
Priority 68/100. Critical severity; EPSS top 5%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2023-42118 HIGH 8.8 MITIGATE Exim libspf2 Integer Underflow Remote Code Execution Vulnerability
- CVE-2021-33912 CRITICAL 9.8 UPGRADE MITIGATE libspf2 before 1.2.11 has a four-byte heap-based buffer overflow that might allow remote attackers to execute
- CVE-2021-20314 CRITICAL 9.8 UPGRADE MITIGATE Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial o