Vulnerabilities / CVE-2021-20204

critical

CVE-2021-20204

A heap memory corruption problem (use after free) can be triggered in ...

Published Modified CWE 119, 416
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).

Description

A heap memory corruption problem (use after free) can be triggered in libgetdata v0.10.0 when processing maliciously crafted dirfile databases. This degrades the confidentiality, integrity and availability of third-party software that uses libgetdata as a library. This vulnerability may lead to arbitrary code execution or privilege escalation depending on input/skills of attacker.

Affected packages and fixed versions

SourcePackageFixed in
debian 10libgetdata0.10.0-5+deb10u1
debian 11libgetdata0.10.0-10
debian 12libgetdata0.10.0-10
debian 13libgetdata0.10.0-10
debian 14libgetdata0.10.0-10
debian 9libgetdata0.9.4-1+deb9u1
echolibgetdata0.10.0-10
ubuntu 18.04-ESMlibgetdatano fix listed
ubuntu 20.04-ESMlibgetdatano fix listed
ubuntu 22.04libgetdatano fix listed
ubuntu 24.04libgetdatano fix listed
ubuntu 26.04libgetdatano fix listed
Show all 13 entries from 13 sources
SourcePackageFixed in
debian 10libgetdata0.10.0-5+deb10u1
debian 11libgetdata0.10.0-10
debian 12libgetdata0.10.0-10
debian 13libgetdata0.10.0-10
debian 14libgetdata0.10.0-10
debian 9libgetdata0.9.4-1+deb9u1
echolibgetdata0.10.0-10
ubuntu 18.04-ESMlibgetdatano fix listed
ubuntu 20.04-ESMlibgetdatano fix listed
ubuntu 22.04libgetdatano fix listed
ubuntu 24.04libgetdatano fix listed
ubuntu 26.04libgetdatano fix listed
ubuntu 26.10libgetdatano fix listed

References

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.