CVE-2021-28361

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-13 · updated 2026-06-17
Weakness: CWE-476

Description

An issue was discovered in Storage Performance Development Kit (SPDK) before 20.01.01. If a PDU is sent to the iSCSI target with a zero length (but data is expected), the iSCSI target can crash with a NULL pointer dereference.

Affected products

Spdk Storage Performance Development Kit: before 20.01.01 — fixed in 20.01.01

How to fix

Upgrade to a fixed version: Spdk Storage Performance Development Kit 20.01.01. Check the vendor advisory for mitigations.

References

https://github.com/spdk/spdk/releases/tag/v21.01.1
https://github.com/spdk/spdk/releases/tag/v21.01.1

Get alerted when CVE-2021-28361 or the next vulnerability affects your stack