What’s Vulnerable › Vulnerabilities

CVE-2021-40540

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-07 · updated 2026-06-17

Description

ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP requests.

Affected products

• Ulfius Project Ulfius: before 2.7.4 — fixed in 2.7.4

How to fix

Upgrade to a fixed version: Ulfius Project Ulfius 2.7.4. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/164152/Ulfius-Web-Framework-Remote-Memory-Corruption.html
• https://github.com/babelouest/ulfius/commit/c83f564c184a27145e07c274b305cabe943bbfaa
• https://github.com/babelouest/ulfius/compare/v2.7.3...v2.7.4
• http://packetstormsecurity.com/files/164152/Ulfius-Web-Framework-Remote-Memory-Corruption.html
• https://github.com/babelouest/ulfius/commit/c83f564c184a27145e07c274b305cabe943bbfaa
• https://github.com/babelouest/ulfius/compare/v2.7.3...v2.7.4

Get alerted when CVE-2021-40540 or the next vulnerability affects your stack