CVE-2021-33910: Debian Linux

Medium severity, CVSS 5.5. EPSS: 8.8% chance of exploitation in the next 30 days.

basic/unit-name.c in systemd prior to 246.15, 247.8, 248.5, and 249.1 has a Memory Allocation with an Excessive Size Value (involving strdupa and alloca for a pathname controlled by a local attacker) that results in an operating system crash.

Affected products

• Debian Debian Linux: version 10.0 only
• Fedoraproject Fedora: version 33 only; version 34 only
• Netapp Hci Management Node: affected versions not specified
• Netapp Solidfire: affected versions not specified
• Systemd Project Systemd: before 246.15 (fixed in 246.15); from 247, before 247.8 (fixed in 247.8); from 248, before 248.5 (fixed in 248.5); from 249, before 249.1 (fixed in 249.1)

Published 2021-07-20. Last modified 2026-06-17.