CVE-2021-4185: oracle http server – CVSS 7.5 · Watchpost

← All vulnerabilities

CVE-2021-4185

HIGH 7.5CVE-2021-4185 · Published 30/12/2021 · updated 17/06/2026

In short

CVE-2021-4185 is a HIGH (CVSS 7.5) vulnerability affecting http server (oracle), zfs storage appliance kit (oracle), wireshark (wireshark).
Chance of exploitation in the next 30 days (EPSS): 4.1%, higher than 90.7% of all vulnerabilities.
Fix: update to 3.4.11 or later.

Package	Affected versions	Patched versions
http server oracle	`= 12.2.1.3.0= 12.2.1.4.0`	No fix yet
zfs storage appliance kit oracle	`= 8.8`	No fix yet
wireshark wireshark	`= 3.6.0≥ 3.4.0, < 3.4.11`	`3.4.11`

Description

Infinite loop in the RTMPT dissector in Wireshark 3.6.0 and 3.4.0 to 3.4.10 allows denial of service via packet injection or crafted capture file

References

gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-4185.json · Third Party Advisory
gitlab.com/wireshark/wireshark/-/issues/17745 · Exploit
lists.debian.org/debian-lts-announce/2022/03/msg00041.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q6XGBKWSQFCVYUN4ZK3O3NJIFP3OAFVT
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R5AEK3XTOIOGCGUILUFISMGX54YJXWGJ
security.gentoo.org/glsa/202210-04 · Third Party Advisory
oracle.com/security-alerts/cpuapr2022.html · Third Party Advisory
wireshark.org/security/wnpa-sec-2021-17.html · Vendor Advisory
lists.debian.org/debian-lts-announce/2024/09/msg00049.html

More vulnerabilities in http server

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free