CVE-2021-43612

HIGH 7.5CVE-2021-43612 · Published 15/04/2023 · updated 17/06/2026

In short

CVE-2021-43612 is a HIGH (CVSS 7.5) vulnerability affecting lldpd (lldpd project).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.7% of all vulnerabilities.
Fix: update to 1.0.13 or later.

Package	Affected versions	Patched versions
lldpd lldpd_project	`< 1.0.13`	`1.0.13`

Description

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.

References

lldpd/lldpd commit 73d4268 · Patch
lldpd/lldpd · Patch
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3T5XHPOGIPWCRRPJUE6P3HVC5PTSD5JS
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JYA4AMJXCNF6UPFG36L2TPPT32C242SP
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKQWHG2SZJZSGC7PXVDAEJYBN7ESDR7D
lldpd.github.io/security.html · Patch

More vulnerabilities in lldpd

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

lldpd

lldpd_project

< 1.0.13

1.0.13

More vulnerabilities in lldpd

See all →