Is CVE-2021-3672 being actively exploited?

CVE-2021-3672 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

What is the CVSS score for CVE-2021-3672?

CVE-2021-3672 has a CVSS 3.1 base score of 5.6 (MEDIUM).

CVE-2021-3672

MEDIUM · CVSS 5.6EPSS 2.8%EU EUVD

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Key facts

CVSS score: 5.6 (v3.1)
Severity: MEDIUM
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness (CWE): CWE-79
EPSS score: 2.8% (86th percentile)
In CISA KEV: No
In EU EUVD: Yes (EUVD-2021-26964)
Published: November 23, 2021
NVD last modified: June 17, 2026
Status: Modified

EU Vulnerability Database (EUVD)

This vulnerability is also tracked by ENISA as EUVD-2021-26964 in the EU Vulnerability Database. Last updated in EUVD on October 15, 2024.

View on the EU Vulnerability Database

Affected products

c-ares project / c-ares
fedoraproject / fedora
fedoraproject / fedora
nodejs / node.js
nodejs / node.js
pgbouncer / pgbouncer
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux
redhat / enterprise linux computer node
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux eus
redhat / enterprise linux for ibm z systems
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for ibm z systems eus
redhat / enterprise linux for power little endian
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux for power little endian eus
redhat / enterprise linux server aus
redhat / enterprise linux server aus
redhat / enterprise linux server tus
redhat / enterprise linux server tus
redhat / enterprise linux server update services for sap solutions
redhat / enterprise linux server update services for sap solutions
redhat / enterprise linux server update services for sap solutions
redhat / enterprise linux tus
redhat / enterprise linux workstation
siemens / sinec infrastructure network services

Certified products that may be affected

32 FIPS 140 or Common Criteria certified products, from automated matching by sec-certs.org.

Red Hat Enterprise Linux 8 NSS Cryptographic Module - Red Hat, Inc. - FIPS 140 5513 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, LLC - FIPS 140 5461 - active
Red Hat Enterprise Linux 8 Kernel Cryptographic API - Red Hat, Inc. - FIPS 140 5089 - active
Red Hat Enterprise Linux 8 OpenSSL Cryptographic Module - Red Hat®, Inc. - FIPS 140 4642 - historical
Red Hat Enterprise Linux 7 NSS Cryptographic Module - Red Hat®, Inc. - FIPS 140 4498 - historical

See all 32 in the Security Certifications Explorer.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1988342(Issue Tracking, Third Party Advisory)
https://c-ares.haxx.se/adv_20210810.html(Exploit, Patch, Vendor Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf(Patch, Third Party Advisory)
https://security.gentoo.org/glsa/202401-02
https://www.oracle.com/security-alerts/cpujul2022.html(Third Party Advisory)

Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS

Query CVEs from your AI assistant

The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.

Add the CVE brain