High
Security advisory
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2021-32476
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 07:11 UTC · Revision 1
Source evidence
A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.
osv:CVE-2021-32476
Complete source record
{
"id": "bc7269b6369cde8984beff2174abee3dadc87911f856bb3eeac952f4962053f0",
"url": "https://osv.dev/vulnerability/CVE-2021-32476",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2021-32476",
"summary": "A denial-of-service risk was identified in the draft files area, due to it not respecting user file upload limits. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8, 3.5 to 3.5.17 and earlier unsupported versions are affected.",
"evidence": "osv:CVE-2021-32476",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2021-32476",
"aliases": [
"BIT-moodle-2021-32476",
"CVE-2021-32476",
"GHSA-4qxc-qxrp-33cw"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/moodle/moodle",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "22984eaeccf9ccd72572cc4cc51ae9372cefa06d"
},
{
"introduced": "f968cd44e8ee5d54b1bc56823040ff770dbf18af"
},
{
"fixed": "49648fdf30aae05b61604a12549436cee8c96436"
},
{
"introduced": "500c131eb49771e36f68d151dfa37fef5a9bc2df"
},
{
"fixed": "270f52bf55acaf121cbae6643a8fa6545d545c3f"
},
{
"introduced": "ec58cefefb2722f61f77c9a2b6a12d40a8c078a0"
},
{
"fixed": "237f4ccada7c8ba85ac9391193293491d8953018"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "3.5.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.8.0"
},
{
"fixed": "3.8.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.9.0"
},
{
"fixed": "3.9.7"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:moodle:moodle:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "3.10.0"
},
{
"fixed": "3.10.4"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v3.10.3",
"v3.9.6",
"v3.10.2",
"v3.5.17",
"v3.8.8",
"v3.9.5",
"v3.5.16",
"v3.8.7",
"v3.10.1",
"v3.9.4",
"v3.9.3",
"v3.5.15",
"v3.8.6",
"v3.10.0",
"v3.9.2",
"v3.8.5",
"v3.5.14",
"v3.5.13",
"v3.8.4",
"v3.9.1",
"v3.9.0",
"v3.8.3",
"v3.5.12",
"v3.8.2",
"v3.5.11",
"v3.5.10",
"v3.8.1",
"v3.8.0",
"v3.5.9",
"v3.5.8",
"v3.5.7",
"v3.5.6",
"v3.5.5",
"v3.5.4",
"v3.5.3",
"v3.5.2",
"v3.5.1",
"v3.5.0",
"v3.5.0-rc1",
"v3.5.0-beta",
"v3.4.0",
"v3.4.0-rc2",
"v3.4.0-rc3",
"v3.4.0-rc1",
"v3.4.0-beta",
"v3.3.0",
"v3.3.0-rc3",
"v3.3.0-rc2",
"v3.3.0-rc1",
"v3.3.0-beta",
"v3.2.0-rc2",
"v3.2.0",
"v3.2.0-rc4",
"v3.2.0-beta",
"v3.2.0-rc5",
"v3.2.0-rc3",
"v3.2.0-rc1",
"v3.1.0-beta",
"v3.1.0",
"v3.1.0-rc2",
"v3.1.0-rc1",
"v3.0.0-rc3",
"v3.0.0",
"v3.0.0-rc4",
"v3.0.0-rc2",
"v3.0.0-rc1",
"v3.0.0-beta",
"v2.9.0",
"v2.9.0-rc2",
"v2.9.0-rc1",
"v2.9.0-beta",
"v2.8.0",
"v2.8.0-rc2",
"v2.8.0-rc1",
"v2.8.0-beta",
"v2.7.0",
"v2.7.0-rc2",
"v2.7.0-rc1",
"v2.7.0-beta",
"v2.6.0",
"v2.6.0-rc1",
"v2.6.0-beta",
"v2.5.0",
"v2.5.0-rc1",
"v2.5.0-beta",
"v2.4.0-beta",
"v2.4.0-rc1",
"v2.4.0",
"v2.3.0",
"v2.3.0-rc1",
"v2.3.0-beta",
"v2.2.0",
"v2.2.0-rc1",
"v2.2.0-beta",
"v2.1.0",
"v2.0.1",
"v2.0.0",
"v2.0.0-rc2",
"v2.0.0-rc1",
"v1.3.0",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.9",
"v1.0.8",
"v1.0.7",
"v1.0.6",
"v1.0.5",
"v1.0.4",
"v1.0.3",
"v1.0.2",
"v1.0.1",
"v1.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32476.json"
}
}
],
"modified": "2026-10-24T10:30:49.865600252Z",
"provider": "osv",
"references": [
"https://moodle.org/mod/forum/discuss.php?d=422310"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2021-32476",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 437087,
"published_at": "2022-03-11T18:15:17.153+00:00"
}