PatchTheCVECVE-2021-46848: GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
68
This week
CRITICAL 9.1REMOTEWATCHLISTUPGRADEMITIGATEMITIGATE
CVE-2021-46848 is a critical-severity flaw (CVSS 9.1) affecting libtasn1, fedora, debian linux. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
Why this priority
- Critical severity
- Public exploit reference
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 2.8% (top 13%) |
| CISA exploited list | No |
| Weakness | CWE-193 |
| Published | 2022-10-24 |
| Last modified | 2026-10-14 |
Last updated 2026-10-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
gnu libtasn1 UPGRADE
Affected: < 4.19.0
Fixed in: 4.19.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy libtasn1 || rpm -q libtasn1 || libtasn1 --version
2. UPGRADE to 4.19.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade libtasn1
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade libtasn1
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
fedoraproject fedora MITIGATE
Affected: 35 · 36 · 37
Fixed in: no fixed release known
Safe to downgrade to: a release before 35
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
debian debian linux MITIGATE
Affected: 10.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 10.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Exact fixes by distribution
A distro patch exists: prefer upgrading over downgrading.
Fedora 46 · lib3mf · FIXED · 2.2.0-25.fc46 · FEDORA-2026-e250630e59 · source
sudo dnf upgrade --advisory=FEDORA-2026-e250630e59
Fedora ELN · libslirp · FIXED · 4.9.7-1.eln159 · FEDORA-2026-209cb94e13 · source
sudo dnf upgrade --advisory=FEDORA-2026-209cb94e13
Ubuntu 22.04 · libtasn1-6 · FIXED · 4.18.0-4ubuntu0.2
sudo apt update && sudo apt install --only-upgrade libtasn1-6
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libtasn1-6)" ge "4.18.0-4ubuntu0.2" && echo PATCHED || echo STILL-VULNERABLE
Ubuntu 24.04 · libtasn1-6 · NOT AFFECTED
Ubuntu 24.10 · libtasn1-6 · NOT AFFECTED
Ubuntu 25.04 · libtasn1-6 · NOT AFFECTED
Ubuntu 25.10 · libtasn1-6 · NOT AFFECTED
Debian 12 · libtasn1-6 · FIXED · 4.19.0-2
sudo apt update && sudo apt install --only-upgrade libtasn1-6
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libtasn1-6)" ge "4.19.0-2" && echo PATCHED || echo STILL-VULNERABLE
Debian 13 · libtasn1-6 · FIXED · 4.19.0-2
sudo apt update && sudo apt install --only-upgrade libtasn1-6
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' libtasn1-6)" ge "4.19.0-2" && echo PATCHED || echo STILL-VULNERABLE
RHEL 8 · libtasn1 · FIXED · libtasn1-4.13-4.el8_7
sudo dnf upgrade --advisory=RHSA-2023:0116
rpm -q libtasn1
RHEL 8.6 Extended Update Support · libtasn1 · FIXED · libtasn1-4.13-3.el8_6.1
sudo dnf upgrade --advisory=RHSA-2024:0427
rpm -q libtasn1
RHEL 9 · libtasn1 · FIXED · libtasn1-4.16.0-8.el9_1
sudo dnf upgrade --advisory=RHSA-2023:0343
rpm -q libtasn1
RHEL 6 · libtasn1 · NOT AFFECTED
RHEL 7 · libtasn1 · DEFERRED
Alpine 3.20 · libtasn1 · FIXED · libtasn1-4.19-r0
apk add --upgrade libtasn1
apk info -v libtasn1
Alpine 3.21 · libtasn1 · FIXED · libtasn1-4.19-r0
apk add --upgrade libtasn1
apk info -v libtasn1
Alpine 3.22 · libtasn1 · FIXED · libtasn1-4.19-r0
apk add --upgrade libtasn1
apk info -v libtasn1
Alpine 3.23 · libtasn1 · FIXED · libtasn1-4.19-r0
apk add --upgrade libtasn1
apk info -v libtasn1
sudo dnf update --advisory=ALAS2023-2023-201
sudo yum update --advisory=ALAS2-2023-1908
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-46848?
libtasn1: upgrade to 4.19.0; fedora: mitigate or apply the listed mitigation; debian linux: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2021-46848 being exploited?
CVE-2021-46848 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-46848 affect?
CVE-2021-46848 affects libtasn1, fedora, debian linux. Severity is critical (CVSS 9.1). GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der.
How urgent is CVE-2021-46848?
Priority 68/100. Critical severity; Public exploit reference; Remotely exploitable, no login, no user action; On your watchlist
Software pages
Related CVEs
- CVE-2025-13151 HIGH 7.5 DOWNGRADE Stack-based buffer overflow in libtasn1 version: v4.20.0