CVE-2021-35942: Debian Linux

Critical severity, CVSS 9.1. EPSS: 2.6% chance of exploitation in the next 30 days.

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Affected products

• Debian Debian Linux: version 10.0 only
• GNU Glibc: before 2.31 (fixed in 2.31)
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp E-Series Santricity OS Controller: from 11.0, up to and including 11.70.1
• Netapp Hci Management Node: affected versions not specified
• Netapp Ontap Select Deploy Administration Utility: affected versions not specified
• Netapp Solidfire: affected versions not specified

Published 2021-07-22. Last modified 2026-06-17.