What’s Vulnerable › Vulnerabilities

CVE-2021-3670

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-23 · updated 2026-06-17
• Weakness: CWE-400

Description

MaxQueryDuration not honoured in Samba AD DC LDAP

Affected products

• Fedoraproject Fedora: 35
• RedHat Storage: 3.0
• Samba: from 4.1.0 before 4.16.0 — fixed in 4.16.0

How to fix

Upgrade to a fixed version: Samba 4.16.0. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=2077533
• https://bugzilla.samba.org/show_bug.cgi?id=14694
• https://gitlab.com/samba-team/samba/-/commit/1d5b155619bc532c46932965b215bd73a920e56f
• https://gitlab.com/samba-team/samba/-/commit/2b3af3b560c9617a233c131376c870fce146c002
• https://gitlab.com/samba-team/samba/-/commit/3507e96b3dcf0c0b8eff7b2c08ffccaf0812a393
• https://gitlab.com/samba-team/samba/-/commit/5f0590362c5c0c5ee20503a67467f9be2d50e73b
• https://gitlab.com/samba-team/samba/-/commit/86fe9d48883f87c928bf31ccbd275db420386803
• https://gitlab.com/samba-team/samba/-/commit/dcfcafdbf756e12d9077ad7920eea25478c29f81
• https://gitlab.com/samba-team/samba/-/commit/e1ab0c43629686d1d2c0b0b2bcdc90057a792049
• https://security.gentoo.org/glsa/202309-06
• https://bugzilla.redhat.com/show_bug.cgi?id=2077533
• https://bugzilla.samba.org/show_bug.cgi?id=14694

Get alerted when CVE-2021-3670 or the next vulnerability affects your stack