CriticalFix available
libspf2 — security advisory
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
- Products
- libspf2
- Affected versions
- Not specified
- Fixed versions
- 1.2.10-r5, 1.2.11-r4
- CVEs
- CVE-2021-20314
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 22:02 UTC · Revision 1
Source evidence
Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.
osv:ALPINE-CVE-2021-20314
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5
libspf2
Fixed versions: 1.2.10-r5, 1.2.11-r4
libspf2
Fixed versions: 1.2.10-r5, 1.2.11-r4
libspf2
Fixed versions: 1.2.10-r5, 1.2.11-r4
libspf2
Fixed versions: 1.2.10-r5, 1.2.11-r4
Complete source record
{
"id": "8979709ef32f95230e6e225e4a438680d599ab006ccbcdfc4f2bfaf69931aa9f",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2021-20314",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2021-20314",
"summary": "Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution via malicious crafted SPF explanation messages.",
"evidence": "osv:ALPINE-CVE-2021-20314",
"products": [
{
"name": {
"value": "libspf2",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/10/ranges"
},
{
"value": "1.2.11-r4",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/11/ranges"
},
{
"value": "1.2.11-r4",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/12/ranges"
},
{
"value": "1.2.11-r4",
"evidence": "/affected/12/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "libspf2",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.2.10-r5",
"evidence": "/affected/13/ranges"
},
{
"value": "1.2.11-r4",
"evidence": "/affected/13/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "ALPINE-CVE-2021-20314",
"aliases": [
"ALPINE-CVE-2021-20314"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.11"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.12"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.13"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.14"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
},
{
"fixed": "1.2.11-r4"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
},
{
"fixed": "1.2.11-r4"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
},
{
"fixed": "1.2.11-r4"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.23"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.2.10-r5"
},
{
"fixed": "1.2.11-r4"
}
]
}
],
"package": {
"name": "libspf2",
"purl": "pkg:apk/alpine/libspf2?arch=source",
"ecosystem": "Alpine:v3.24"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2021-20314.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-23T17:17:56.147326757Z",
"provider": "osv",
"upstream": [
"CVE-2021-20314"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2021-20314"
]
},
"related_cves": [
{
"value": "CVE-2021-20314",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 415294,
"published_at": "2021-08-12T15:15:07.657+00:00"
}