critical
CVE-2021-26937
screen: crash when processing combining chars
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Trivy's own label is CRITICAL. Rated critical by NVD, CBL-Mariner. Rated lower by Red Hat (high), Amazon (high), Oracle (high), Ubuntu (medium).
Description
encoding.c in GNU Screen through 4.8.0 allows remote attackers to cause a denial of service (invalid write access and application crash) or possibly have unspecified other impact via a crafted UTF-8 character sequence.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 2.0 | screen | 0:4.9.1-1.cm2 |
| alpine 3.10 | screen | 4.6.2-r2 |
| alpine 3.11 | screen | 4.7.0-r2 |
| alpine 3.12 | screen | 4.8.0-r1 |
| alpine 3.13 | screen | 4.8.0-r4 |
| alpine 3.14 | screen | 4.8.0-r4 |
| alpine 3.15 | screen | 4.8.0-r4 |
| alpine 3.16 | screen | 4.8.0-r4 |
| alpine 3.17 | screen | 4.8.0-r4 |
| alpine 3.18 | screen | 4.8.0-r4 |
| alpine 3.19 | screen | 4.8.0-r4 |
| alpine 3.20 | screen | 4.8.0-r4 |
Show all 40 entries from 37 sources
| Source | Package | Fixed in |
|---|---|---|
| CBL-Mariner 2.0 | screen | 0:4.9.1-1.cm2 |
| alpine 3.10 | screen | 4.6.2-r2 |
| alpine 3.11 | screen | 4.7.0-r2 |
| alpine 3.12 | screen | 4.8.0-r1 |
| alpine 3.13 | screen | 4.8.0-r4 |
| alpine 3.14 | screen | 4.8.0-r4 |
| alpine 3.15 | screen | 4.8.0-r4 |
| alpine 3.16 | screen | 4.8.0-r4 |
| alpine 3.17 | screen | 4.8.0-r4 |
| alpine 3.18 | screen | 4.8.0-r4 |
| alpine 3.19 | screen | 4.8.0-r4 |
| alpine 3.20 | screen | 4.8.0-r4 |
| alpine 3.21 | screen | 4.8.0-r4 |
| alpine 3.22 | screen | 4.8.0-r4 |
| alpine 3.23 | screen | 4.8.0-r4 |
| alpine 3.24 | screen | 4.8.0-r4 |
| alpine edge | screen | 4.8.0-r4 |
| amazon linux 1 | screen | 4.0.3-19.7.amzn1 |
| amazon linux 1 | screen-debuginfo | 4.0.3-19.7.amzn1 |
| amazon linux 2 | screen | 4.1.0-0.27.20120314git3c2946.amzn2 |
| amazon linux 2 | screen-debuginfo | 4.1.0-0.27.20120314git3c2946.amzn2 |
| debian 10 | screen | 4.6.2-3+deb10u1 |
| debian 11 | screen | 4.8.0-5 |
| debian 12 | screen | 4.8.0-5 |
| debian 13 | screen | 4.8.0-5 |
| debian 14 | screen | 4.8.0-5 |
| debian 9 | screen | 4.5.0-6+deb9u1 |
| echo | screen | 4.8.0-5 |
| Oracle Linux 7 | screen | 4.1.0-0.27.20120314git3c2946.el7_9 |
| Red Hat | screen | no fix listed |
| seal Red Hat 7 | screen | 4.1.0-0.27.20120314git3c2946.el7_9+sp999 |
| seal Red Hat 7 | seal-screen | 4.1.0-0.27.20120314git3c2946.el7_9+sp999 |
| ubuntu 14.04-ESM | screen | 4.1.0~20120320gitdb59704-9ubuntu0.1~esm2 |
| ubuntu 16.04 | screen | 4.3.1-2ubuntu0.1 |
| ubuntu 16.04-ESM | screen | 4.3.1-2ubuntu0.1 |
| ubuntu 18.04 | screen | 4.6.2-1ubuntu1.1 |
| ubuntu 18.04-ESM | screen | 4.6.2-1ubuntu1.1 |
| ubuntu 20.04 | screen | 4.8.0-1ubuntu0.1 |
| ubuntu 20.04-ESM | screen | 4.8.0-1ubuntu0.1 |
| ubuntu 20.10 | screen | 4.8.0-2ubuntu0.1 |
References
- http://www.openwall.com/lists/oss-security/2021/02/09/8
- https://access.redhat.com/security/cve/CVE-2021-26937
- https://ftp.gnu.org/gnu/screen/
- https://linux.oracle.com/cve/CVE-2021-26937.html
- https://linux.oracle.com/errata/ELSA-2021-0742.html
- https://lists.debian.org/debian-lts-announce/2021/02/msg00031.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GNWBOIDEPOEQS5RMQVMFKHKXJCGNYWBL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JJWLXP45POUUYBJRRWPVAWNZDJTLYWVM/
All 19 references
- https://lists.gnu.org/archive/html/screen-devel/2021-02/msg00000.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-26937
- https://seclists.org/oss-sec/2021/q1/124
- https://seclists.org/oss-sec/2021/q1/129
- https://security.gentoo.org/glsa/202105-11
- https://security.netapp.com/advisory/ntap-20250509-0004/
- https://ubuntu.com/security/notices/USN-4747-1
- https://ubuntu.com/security/notices/USN-4747-2
- https://www.cve.org/CVERecord?id=CVE-2021-26937
- https://www.debian.org/security/2021/dsa-4861
- https://www.openwall.com/lists/oss-security/2021/02/09/3