{"id":"CVE-2021-35942","revision":"225b09dbeb304bcf80a69ddda9f0e84c","records":[{"revision":"225b09dbeb304bcf80a69ddda9f0e84c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2021-35942","aliases":[],"title":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclo…","description":"The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.","state":0,"publishedAt":"2021-07-22T00:00:00+00:00","modifiedAt":"2026-10-14T11:48:50.934+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"n/a\",\n                    \"product\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"version\": \"n/a\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://sourceware.org/glibc/wiki/Security%20Exceptions","https://sourceware.org/bugzilla/show_bug.cgi?id=28011","https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c","https://security.netapp.com/advisory/ntap-20210827-0005/","https://security.gentoo.org/glsa/202208-24","https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2021-35942","license":"CVE Program Terms of Use","key":"cve-program:CVE-2021-35942","identifiers":["CVE-2021-35942"]},"retained":false,"historicalAffected":[]}],"coverage":[]}