CVE-2021-28041: Fedoraproject Fedora

High severity, CVSS 7.1. EPSS: 3.4% chance of exploitation in the next 30 days.

ssh-agent in OpenSSH before 8.5 has a double free that may be relevant in a few less-common scenarios, such as unconstrained agent-socket access on a legacy operating system, or the forwarding of an agent to an attacker-controlled host.

Affected products

• Fedoraproject Fedora: version 33 only; version 34 only
• Netapp Cloud Backup: affected versions not specified
• Netapp Hci Compute Node Firmware: affected versions not specified
• Netapp Hci Management Node: affected versions not specified
• Netapp Hci Storage Node Firmware: affected versions not specified
• Netapp Solidfire: affected versions not specified
• OpenBSD OpenSSH: from 8.2, before 8.5 (fixed in 8.5)
• Oracle Communications Offline Mediation Controller: version 12.0.0.3.0 only
• Oracle ZFS Storage Appliance: version 8.8 only

Published 2021-03-05. Last modified 2026-06-17.