CVE-2021-31826: Shibboleth Service Provider

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

Shibboleth Service Provider 3.x before 3.2.2 is prone to a NULL pointer dereference flaw involving the session recovery feature. The flaw is exploitable (for a daemon crash) on systems not using this feature if a crafted cookie is supplied.

Affected products

• Shibboleth Service Provider: from 3.0.0, before 3.2.2 (fixed in 3.2.2)

Published 2021-04-27. Last modified 2026-06-17.