CVE-2021-20201

MEDIUM 5.3CVE-2021-20201 · Published 28/05/2021 · updated 17/06/2026

In short

CVE-2021-20201 is a MEDIUM (CVSS 5.3) vulnerability affecting spice (spice project).
Chance of exploitation in the next 30 days (EPSS): 2.7%, higher than 85.9% of all vulnerabilities.
Fix: update to 0.14.92 or later.

Package	Affected versions	Patched versions
spice spice_project	`< 0.14.92`	`0.14.92`

Description

A flaw was found in spice in versions before 0.14.92. A DoS tool might make it easier for remote attackers to cause a denial of service (CPU consumption) by performing many renegotiations within a single connection.

References

blog.qualys.com/product-tech/2011/10/31/tls-renegotiation-and-denial-of-service-attacks · Exploit
bugzilla.redhat.com/show_bug.cgi · Issue Tracking
security.gentoo.org/glsa/202208-10 · Third Party Advisory

More vulnerabilities in spice

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

spice

spice_project

< 0.14.92

0.14.92

More vulnerabilities in spice

See all →