CVE-2021-43399: Yubico Yubihsm 2 Software Development Kit

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHSM 2 device.

Affected products

• Yubico Yubihsm 2 Software Development Kit: up to and including 2021.08

Published 2021-12-08. Last modified 2026-06-17.