CVE-2021-27576: Apache OpenMeetings: bandwidth can be overloaded with public web service

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-15 · updated 2026-06-17

Description

If was found that the NetTest web service can be used to overload the bandwidth of a Apache OpenMeetings server. This issue was addressed in Apache OpenMeetings 6.0.0

Affected products

Apache Software Foundation Apache OpenMeetings: from 4.0.0 before 6.0.0 — fixed in 6.0.0

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache OpenMeetings 6.0.0. Check the vendor advisory for mitigations.

References

https://lists.apache.org/thread.html/r9bb615bd70a0197368f5f3ffc887162686caeb0b5fc30592a7a871e9%40%3Cuser.openmeetings.apache.org%3E
https://lists.apache.org/thread.html/r9bb615bd70a0197368f5f3ffc887162686caeb0b5fc30592a7a871e9%40%3Cuser.openmeetings.apache.org%3E

Get alerted when CVE-2021-27576 or the next vulnerability affects your stack