← Vulnerability feed

Vulnerability record · CVE-2021-33586 · published 27 May 2021

CVE-2021-33586: Inspircd incorrect permission assignment vulnerability

Inspircd · Inspircd

InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.

4.3 CVSS 3.1 Medium EPSS 0.89% · top 41.8% CWE-732 · Incorrect permission assignment
4.3CVSS 3.1 base score, v2 4.0
0.89%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://docs.inspircd.org/security/2021-01/ PatchVendor Advisory
https://github.com/inspircd/inspircd/commit/4350a11c663b0d75f8119743bffb7736d87abd4d PatchThird Party Advisory
https://security.gentoo.org/glsa/202107-22 Third Party Advisory
https://docs.inspircd.org/security/2021-01/ PatchVendor Advisory
https://github.com/inspircd/inspircd/commit/4350a11c663b0d75f8119743bffb7736d87abd4d PatchThird Party Advisory
https://security.gentoo.org/glsa/202107-22 Third Party Advisory

Track CVE-2021-33586 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2012-6696Inspircd improper input validation vulnerabilityinspircd in Debian before 2.0.7 does not properly handle unsigned integers. NOTE: This vulnerability exists because of an incomplete fix to CVE-2012-…EPSS 1.6%9.8CVE-2015-6674Inspircd memory buffer overflow vulnerabilityBuffer underflow vulnerability in the Debian inspircd package before 2.0.5-1+deb7u1 for wheezy and before 2.0.16-1 for jessie and sid. NOTE: This iss…EPSS 2.3%8.6CVE-2015-8702Debian linux improper input validation vulnerabilityThe DNS::GetResult function in dns.cpp in InspIRCd before 2.0.19 allows remote DNS servers to cause a denial of service (netsplit) via an invalid cha…EPSS 2.3%7.5CVE-2012-1836Inspircd memory buffer overflow vulnerabilityHeap-based buffer overflow in dns.cpp in InspIRCd 2.0.5 might allow remote attackers to execute arbitrary code via a crafted DNS query that uses comp…EPSS 6.8%6.5CVE-2019-20918Inspircd use after free vulnerabilityAn issue was discovered in InspIRCd 3 before 3.1.0. The silence module contains a use after free vulnerability. This vulnerability can be used for re…EPSS 1.5%6.5CVE-2020-25269Inspircd use after free vulnerabilityAn issue was discovered in InspIRCd 2 before 2.0.29 and 3 before 3.6.0. The pgsql module contains a use after free vulnerability. When combined with …EPSS 2.7%6.5CVE-2019-20917Inspircd null pointer dereference vulnerabilityAn issue was discovered in InspIRCd 2 before 2.0.28 and 3 before 3.3.0. The mysql module contains a NULL pointer dereference when built against maria…EPSS 2.8%5.9CVE-2016-7142Inspircd permissions and access controls vulnerabilityThe m_sasl module in InspIRCd before 2.0.23, when used with a service that supports SASL_EXTERNAL authentication, allows remote attackers to spoof ce…EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2021-33586), CISA KEV, FIRST EPSS (scores of 2026-10-10). This page is refreshed as NVD updates the record.