kbrain

CVE-2021-3449

MEDIUM · CVSS 5.9EPSS 63.5%EU EUVD

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension (where it was present in the initial ClientHello), but includes a signature_algorithms_cert extension then a NULL pointer dereference will result, leading to a crash and a denial of service attack. A server is only vulnerable if it has TLSv1.2 and renegotiation enabled (which is the default configuration). OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. Fixed in OpenSSL 1.1.1k (Affected 1.1.1-1.1.1j).

Key facts

CVSS score
5.9 (v3.1)
Severity
MEDIUM
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE)
CWE-476
EPSS score
63.5% (99th percentile)
In CISA KEV
No
In EU EUVD
Yes (EUVD-2021-1628)
Published
March 25, 2021
NVD last modified
October 8, 2026
Status
Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2021-1628 in the EU Vulnerability Database. Last updated in EUVD on October 8, 2026.

View on the EU Vulnerability Database

Affected products

  • checkpoint / multi-domain management
  • checkpoint / multi-domain management firmware
  • checkpoint / multi-domain management firmware
  • checkpoint / quantum security gateway
  • checkpoint / quantum security gateway firmware
  • checkpoint / quantum security gateway firmware
  • checkpoint / quantum security management
  • checkpoint / quantum security management firmware
  • checkpoint / quantum security management firmware
  • debian / debian linux
  • debian / debian linux
  • fedoraproject / fedora
  • freebsd / freebsd
  • freebsd / freebsd
  • freebsd / freebsd
  • mcafee / web gateway
  • mcafee / web gateway
  • mcafee / web gateway
  • mcafee / web gateway cloud service
  • mcafee / web gateway cloud service
  • mcafee / web gateway cloud service
  • netapp / active iq unified manager
  • netapp / cloud volumes ontap mediator
  • netapp / e-series performance analyzer
  • netapp / oncommand insight
  • netapp / oncommand workflow automation
  • netapp / ontap select deploy administration utility
  • netapp / santricity smi-s provider
  • netapp / snapcenter
  • netapp / storagegrid
  • nodejs / node.js
  • nodejs / node.js
  • openssl / openssl
  • oracle / communications communications policy management
  • oracle / enterprise manager for storage management
  • oracle / essbase
  • oracle / graalvm
  • oracle / graalvm
  • oracle / graalvm
  • oracle / jd edwards enterpriseone tools
  • oracle / jd edwards world security
  • oracle / mysql connectors
  • oracle / mysql server
  • oracle / mysql workbench
  • oracle / peoplesoft enterprise peopletools
  • oracle / peoplesoft enterprise peopletools
  • oracle / peoplesoft enterprise peopletools
  • oracle / primavera unifier
  • oracle / primavera unifier
  • oracle / primavera unifier

and 147 more…

Certified products that may be affected

5 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

References

Last updated October 10, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain
CVE-2021-3449: MEDIUM severity (CVSS 5.9)