Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6pd1-d9gx-kfc1
Vulnerability ID VCID-6pd1-d9gx-kfc1
Aliases CVE-2021-4044
GHSA-mmjf-f5jw-w72q
Summary Loop with Unreachable Exit Condition ('Infinite Loop') Internally libssl in OpenSSL calls X509_verify_cert() on the client side to verify a certificate supplied by a server. The exact behaviour will depend on the application but it could result in crashes, infinite loops or other similar incorrect responses.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-252 Unchecked Return Value
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-4044.json
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.1758 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.3328 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.3328 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
epss 0.3328 https://api.first.org/data/v1/epss?cve=CVE-2021-4044
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-mmjf-f5jw-w72q
cvssv3.1 7.5 https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=758754966791c537ea95241438454aa86f91f256
generic_textual HIGH https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=758754966791c537ea95241438454aa86f91f256
cvssv3.1 7.5 https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256
generic_textual HIGH https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-4044
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2021-4044
cvssv3.1 7.5 https://rustsec.org/advisories/RUSTSEC-2021-0129.html
generic_textual HIGH https://rustsec.org/advisories/RUSTSEC-2021-0129.html
archlinux Medium https://security.archlinux.org/AVG-2641
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20211229-0003
generic_textual HIGH https://security.netapp.com/advisory/ntap-20211229-0003
cvssv3.1 7.5 https://www.openssl.org/news/secadv/20211214.txt
generic_textual HIGH https://www.openssl.org/news/secadv/20211214.txt
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-4044.json
https://api.first.org/data/v1/epss?cve=CVE-2021-4044
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=758754966791c537ea95241438454aa86f91f256
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256
https://rustsec.org/advisories/RUSTSEC-2021-0129.html
https://security.netapp.com/advisory/ntap-20211229-0003
https://security.netapp.com/advisory/ntap-20211229-0003/
https://www.openssl.org/news/secadv/20211214.txt
2033761 https://bugzilla.redhat.com/show_bug.cgi?id=2033761
AVG-2641 https://security.archlinux.org/AVG-2641
CVE-2021-4044 https://nvd.nist.gov/vuln/detail/CVE-2021-4044
GHSA-mmjf-f5jw-w72q https://github.com/advisories/GHSA-mmjf-f5jw-w72q
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-4044.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=758754966791c537ea95241438454aa86f91f256
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=758754966791c537ea95241438454aa86f91f256
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-4044
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://rustsec.org/advisories/RUSTSEC-2021-0129.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20211229-0003
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://www.openssl.org/news/secadv/20211214.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.95057
EPSS Score 0.1758
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:49:10.755293+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/conan/openssl/CVE-2021-4044.yml 38.0.0