CVE-2021-28361: Spdk Storage Performance Development Kit

High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days.

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

Affected products

• Spdk Storage Performance Development Kit: before 20.01.01 (fixed in 20.01.01)

Published 2021-03-13. Last modified 2026-06-17.