No exploitation reportedFix available

CVE-2021-3672

Q: Is CVE-2021-3672 actively exploited?

Active exploitation of CVE-2021-3672 has not been confirmed. Its EPSS score was 2.8% on 2026-10-23, the estimated probability of exploitation in the next 30 days.

Q: What is the CVSS score for CVE-2021-3672?

CVE-2021-3672 has a CVSS v3 base score of 5.6 (MEDIUM severity), with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.

No exploitation reported by the sources we read.

Published2021-11-23
Fixed in16.6.2 · 14.17.5 · 14.14.1 · 12.22.5 · 12.12.1
WeaknessCWE-79

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.

Timeline

dates in UTC

2021-11-2319:15CVE publishedNVD

Observed activity

isMalicious corpus · updated 2026-10-23 21:37 UTC

Indicators tagged with this CVE, per day0 indicators over 7 days

Block these indicators

Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2021-3672?format=txt
CSV export: https://api.ismalicious.com/edl/cve/CVE-2021-3672?format=csv
TAXII collection of exploited CVEs
The EDL and CSV take an API key on the Pro plan.

Versions per branch

NVD · OSV

Node.js

Branch	Affected	Fixed in	Source
16.x	≥ 16.0.0, < 16.6.2	16.6.2	NVD · OSV
14.x	≥ 14.15.0, < 14.17.5	14.17.5	NVD · OSV
14.x	≥ 14.0.0, < 14.14.1	14.14.1	OSV
12.x	≥ 12.13.0, < 12.22.5	12.22.5	NVD · OSV
12.x	≥ 12.0.0, < 12.12.1	12.12.1	OSV
12.x	≥ 12.0.0, ≤ 12.12.0	no fix published	NVD
14.x	≥ 14.0.0, ≤ 14.14.0	no fix published	NVD

Redhat enterprise linux eus

Branch	Affected	Fixed in	Source
7.7	= 7.7	no fix published	NVD
8.1	= 8.1	no fix published	NVD
8.2	= 8.2	no fix published	NVD
8.4	= 8.4	no fix published	NVD

Redhat enterprise linux

Branch	Affected	Fixed in	Source
7.0	= 7.0	no fix published	NVD
7.7	= 7.7	no fix published	NVD
8.0	= 8.0	no fix published	NVD

15 more products in the sources.

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Packages

c-aresAlmaLinux:8all versions · fixed in 1.13.0-6.el8and 1 other package
nodejsAlmaLinux:8all versions · fixed in 1:12.22.5-1.module_el8.5.0+85+79a7b441and 2 other packages
nodejsAlmaLinux:8all versions · fixed in 1:12.22.5-1.module_el8.4.0+2529+af52a4c7and 3 other packages
nodejs-nodemonAlmaLinux:8all versions · fixed in 2.0.3-1.module_el8.4.0+2521+c668cc9f
nodejs-packagingAlmaLinux:8all versions · fixed in 23-3.module_el8.4.0+2522+3bd42762
nodejs-packagingAlmaLinux:8all versions · fixed in 17-3.module_el8.3.0+2023+d2377ea3
nodejs-packagingAlmaLinux:8all versions · fixed in 17-3.module_el8.4.0+2224+b07ac28e
nodejs-packagingAlmaLinux:8all versions · fixed in 17-3.module_el8.4.0+2521+c668cc9f

3 more package ranges on OSV.dev

Vendor advisories

CVE-2021-3672 Red Hat Product Security215 products fixed · 5 known affected
c-ares: Missing input validation of host names may lead to domain hijacking
c-ares-devel as a component of Red Hat Enterprise Linux 6 · c-ares.src as a component of Red Hat Enterprise Linux 6 · c-ares as a component of Red Hat Enterprise Linux 7 · +2 more
RHSA-2022:2043 Red Hat Product Security21 products fixed
Red Hat Security Advisory: c-ares security update
ICSA-22-069-09 CISA1 known affected
Siemens SINEC INS
SINEC INS
SSA-389290 Siemens ProductCERT1 known affected
SSA-389290: Third-Party Component Vulnerabilities in SINEC INS
SINEC INS
RHSA-2021:3666 Red Hat Product Security30 products fixed
Red Hat Security Advisory: nodejs:14 security and bug fix update
RHSA-2021:3638 Red Hat Product Security30 products fixed
Red Hat Security Advisory: nodejs:12 security and bug fix update

4 more advisories

Full record on NVD

Fix

Update Node.js to 16.6.2 · 14.17.5 · 14.14.1 · 12.22.5 · 12.12.1
Vendor fix Red Hat Product Security RHSA-2022:2043 · 21 productsFor details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
Vendor fix Siemens ProductCERT SSA-389290 · 1 productUpdate to V1.0.1.1 or later version
Vendor fix CISA ICSA-22-069-09 · 1 productUpdate to V1.0.1.1 or later version
No fix planned, says the vendor Red Hat Product Security CVE-2021-3672 · 5 productsOut of support scope

Advisories and patches

c-ares.haxx.sePatch · Vendor Advisory
cert-portal.siemens.comPatch

Detection

Nuclei template: none so far
Exploit-DB: no entry
Proof-of-concept repositories: none listed

Sources

CISA-ADPSSVC decisionnone2024-10-15
OpenCVESSVC decisionnone—
NVDCVSS 3.15.6read 2026-10-23
NVDCVSS 2.06.8read 2026-10-23
CNAweakness (CWE)CWE-79read 2026-10-23
NVDweakness (CWE)CWE-79read 2026-10-23
FIRST EPSSEPSS score2.8 %2026-10-23
OSVaffected packages—

Technical details

CVSS v3 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Published: 2021-11-23
Last Modified: 2026-06-17
NVD status: Modified

Frequently asked questions

What is CVE-2021-3672?

Is CVE-2021-3672 actively exploited?

Active exploitation of CVE-2021-3672 has not been confirmed. Its EPSS score was 2.8% on 2026-10-23, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2021-3672?

CVE-2021-3672 has a CVSS v3 base score of 5.6 (MEDIUM severity), with vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L.

Running c-ares? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this product CISA KEV additions, October 2026 Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database