What’s Vulnerable › Vulnerabilities

CVE-2021-3998

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-08-24 · updated 2026-10-14
• Weakness: CWE-125

Description

A flaw was found in glibc. The realpath() function can mistakenly return an unexpected value, potentially leading to information leakage and disclosure of sensitive data.

Affected products

• GNU C Library (glibc): from 2.33 before 2.35 — fixed in 2.35
• NetApp H300S Firmware: all versions
• NetApp H410C Firmware: all versions
• NetApp H410S Firmware: all versions
• NetApp H500S Firmware: all versions
• NetApp H700S Firmware: all versions
• NetApp ONTAP Select Deploy administration utility: all versions

How to fix

Upgrade to a fixed version: GNU C Library (glibc) 2.35. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/security/cve/CVE-2021-3998
• https://bugzilla.redhat.com/show_bug.cgi?id=2024633
• https://security-tracker.debian.org/tracker/CVE-2021-3998
• https://security.netapp.com/advisory/ntap-20221020-0003/
• https://sourceware.org/bugzilla/show_bug.cgi?id=28770
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=84d2d0fe20bdf94feed82b21b4d7d136db471f03
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ee8d5e33adb284601c00c94687bc907e10aec9bb
• https://www.openwall.com/lists/oss-security/2022/01/24/4
• https://access.redhat.com/security/cve/CVE-2021-3998
• https://bugzilla.redhat.com/show_bug.cgi?id=2024633
• https://security-tracker.debian.org/tracker/CVE-2021-3998
• https://security.netapp.com/advisory/ntap-20221020-0003/

Get alerted when CVE-2021-3998 or the next vulnerability affects your stack