CVE-2021-35942
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted…
Published Jul 22, 2021 · updated Oct 14, 2026 · gnu glibc
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
Timeline
Detection, updates, and resolution for this record.
Jul 22, 2021 · NIST NVD
Detected
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
Oct 14, 2026 · NIST NVD
Updated
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.
Affected
- cpe debian/debian linux10.0
- cpe gnu/glibcversion unspecified
- cpe netapp/active iq unified managerversion unspecified
- cpe netapp/e-series santricity os controllerversion unspecified
- cpe netapp/hci management nodeversion unspecified
- cpe netapp/ontap select deploy administration utilityversion unspecified
- cpe netapp/solidfireversion unspecified
Sources
- CVE.orgCVE-2021-35942
Official CVE identifier
cve.org - NIST NVDCVE-2021-35942
The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because
nvd.nist.gov