GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c…
Priority MEDIUM 40CWE-190Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 7 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffer overflow via crafted input, leading to a segmentation fault on 32-bit platforms.
Why it matters now
EPSS 0.04464 91st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 6 advisoriesRed Hat: 7 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 13
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gmplib:gmp:*:*:*:*:*:*:x86:* | up to 6.2.1 | Vulnerable | Gmplib |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:gmplib:gmp:*:*:*:*:*:*:x86:* Versions up to 6.2.1 Vulnerable ·Gmplib
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
Red Hat 6 advisories
- RHSA-2024:3214 Released 2024-05-22 · Red Hat rating Moderategmp security update
- Red Hat Enterprise Linux BaseOS (v. 8) gmp-1:6.1.2-11.el8, gmp-c++-1:6.1.2-11.el8, gmp-devel-1:6.1.2-11.el8
- RHSA-2024:2092 Released 2024-05-01 · Red Hat rating Moderatesecurity update Logging for Red Hat OpenShift - 5.6.18
- RHOL 5.6 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
- RHSA-2024:2093 Released 2024-05-01 · Red Hat rating Moderatesecurity update Logging for Red Hat OpenShift - 5.7.13
- RHOL 5.7 for RHEL 8 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-operator-bundle +15
Show 3 more Red Hat advisories
- RHSA-2024:1412 Released 2024-03-19 · Red Hat rating Moderategmp update
- Red Hat Enterprise Linux BaseOS EUS (v.8.8) gmp-1:6.1.2-11.el8_8.1, gmp-c++-1:6.1.2-11.el8_8.1, gmp-devel-1:6.1.2-11.el8_8.1
- RHSA-2024:1102 Released 2024-03-05 · Red Hat rating Moderategmp security update
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) gmp-1:6.1.2-11.el8_6.1, gmp-c++-1:6.1.2-11.el8_6.1, gmp-devel-1:6.1.2-11.el8_6.1
- RHSA-2023:6661 Released 2023-11-07 · Red Hat rating Lowgmp security and enhancement update
- Red Hat Enterprise Linux AppStream (v. 9) gmp-c++-1:6.2.0-13.el9, gmp-devel-1:6.2.0-13.el9
- Red Hat Enterprise Linux BaseOS (v. 9) gmp-1:6.2.0-13.el9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| RHOL 5.6 for RHEL 8 | Fixed | RHSA-2024:2092 |
| RHOL 5.7 for RHEL 8 | Fixed | RHSA-2024:2093 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2023:6661 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2024:3214 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2023:6661 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.6) | Fixed | RHSA-2024:1102 |
| Red Hat Enterprise Linux BaseOS EUS (v.8.8) | Fixed | RHSA-2024:1412 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43618
- 2026-10-03 Alias added: GHSA-mfg4-w44m-wr4g
- 2026-10-16 EPSS moved to the 90th–95th percentile
- 2026-10-16 Priority changed: LOW → MEDIUM
References
Advisory 6
- https://bugs.debian.org/994405
- [debian-lts-announce] 20211202 [SECURITY] [DLA 2837-1] gmp security update
- [oss-security] 20221013 Re: sagemath denial of service with abort() in gmp: overflow in mpz type
- 20221016 Re: over 2000 packages depend on abort()ing libgmp
- https://security.netapp.com/advisory/ntap-20221111-0001/
- GLSA-202309-13
Sources
- CVE-2021-43618 · CVE Program
- CVE-2021-43618 · NVD
- FIRST EPSS
- GHSA-mfg4-w44m-wr4g · GitHub Advisory Database · CC BY 4.0
- CVE-2021-43618 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences