What’s Vulnerable › Vulnerabilities

CVE-2021-36773

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-07-18 · updated 2026-06-17
• Weakness: CWE-674

Description

uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support an arbitrary depth of parameter nesting for strict blocking, which allows crafted web sites to cause a denial of service (unbounded recursion that can trigger memory consumption and a loss of all blocking functionality).

Affected products

• Debian Linux: 9.0
• Sciruby Nmatrix: before 4.4.9 — fixed in 4.4.9
• Ublockorigin Ublock Origin: before 1.36.2 — fixed in 1.36.2
• Umatrix Project Umatrix: before 1.4.2 — fixed in 1.4.2

How to fix

Upgrade to a fixed version: Sciruby Nmatrix 4.4.9; Ublockorigin Ublock Origin 1.36.2; Umatrix Project Umatrix 1.4.2. Check the vendor advisory for mitigations.

References

• https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
• https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html
• https://news.ycombinator.com/item?id=27833752
• https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc
• https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html
• https://news.ycombinator.com/item?id=27833752

Get alerted when CVE-2021-36773 or the next vulnerability affects your stack