Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2021-3520: There's a flaw in lz4

62
This week
CRITICAL 9.8REMOTEUPGRADEMITIGATEMITIGATE

CVE-2021-3520 is a critical-severity flaw (CVSS 9.8) affecting lz4, active iq unified manager, cloud backup. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well.

Why this priority

  • Critical severity
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score9.8 (Critical)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance3.4% (top 11%)
CISA exploited listNo
WeaknessCWE-190, CWE-787
Published2021-06-02
Last modified2026-10-14
Publisher (CNA): Red Hat, Inc. · Vendor: lz4 project · netapp · oracle

Share: LinkedIn · X · Reddit

Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

lz4 project lz4 UPGRADE
Affected: >= 1.8.3 and < 1.9.4
Fixed in: 1.9.4
Safe to downgrade to: a release before 1.8.3
1. Check installed version
apt-cache policy lz4 || rpm -q lz4 || lz4 --version
2. UPGRADE to 1.9.4 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade lz4
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade lz4
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 1.8.3 (Debian / Ubuntu)
apt-cache madison lz4 sudo apt install lz4=<VERSION_BEFORE_1.8.3> sudo apt-mark hold lz4
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list lz4 sudo dnf downgrade lz4-<VERSION_BEFORE_1.8.3> sudo dnf versionlock add lz4
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
netapp active iq unified manager MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy active-iq-unified-manager || rpm -q active-iq-unified-manager || active-iq-unified-manager --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
netapp cloud backup MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy cloud-backup || rpm -q cloud-backup || cloud-backup --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
netapp ontap select deploy administration utility MITIGATE
Affected: all versions
Fixed in: no fixed release known
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy ontap-select-deploy-administration-utility || rpm -q ontap-select-deploy-administration-utility || ontap-select-deploy-administration-utility --version
No fixed or unaffected release known
Apply the vendor mitigation from the advisory, disable the affected feature, or restrict network access.
oracle communications cloud native core policy DOWNGRADE
Affected: 1.14.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 1.14.0
1. Check installed version
apt-cache policy communications-cloud-native-core-policy || rpm -q communications-cloud-native-core-policy || communications-cloud-native-core-policy --version
2. No fixed release: DOWNGRADE to a release before 1.14.0 (Debian / Ubuntu)
apt-cache madison communications-cloud-native-core-policy sudo apt install communications-cloud-native-core-policy=<VERSION_BEFORE_1.14.0> sudo apt-mark hold communications-cloud-native-core-policy
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list communications-cloud-native-core-policy sudo dnf downgrade communications-cloud-native-core-policy-<VERSION_BEFORE_1.14.0> sudo dnf versionlock add communications-cloud-native-core-policy
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
oracle zfs storage appliance kit DOWNGRADE
Affected: 8.8
Fixed in: no fixed release known
Safe to downgrade to: a release before 8.8
1. Check installed version
apt-cache policy zfs-storage-appliance-kit || rpm -q zfs-storage-appliance-kit || zfs-storage-appliance-kit --version
2. No fixed release: DOWNGRADE to a release before 8.8 (Debian / Ubuntu)
apt-cache madison zfs-storage-appliance-kit sudo apt install zfs-storage-appliance-kit=<VERSION_BEFORE_8.8> sudo apt-mark hold zfs-storage-appliance-kit
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list zfs-storage-appliance-kit sudo dnf downgrade zfs-storage-appliance-kit-<VERSION_BEFORE_8.8> sudo dnf versionlock add zfs-storage-appliance-kit
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2021-3520?

lz4: upgrade to 1.9.4; active iq unified manager: mitigate or apply the listed mitigation; cloud backup: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2021-3520 being exploited?

CVE-2021-3520 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2021-3520 affect?

CVE-2021-3520 affects lz4, active iq unified manager, cloud backup. Severity is critical (CVSS 9.8). There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a

How urgent is CVE-2021-3520?

Priority 62/100. Critical severity; Remotely exploitable, no login, no user action

Related CVEs

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.